From James.Gates@sun.com Mon Nov 17 11:20:22 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAHJKLpE018886; Mon, 17 Nov 2008 11:20:21 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mAHJKIBn019008; Mon, 17 Nov 2008 19:20:20 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAH00903SDVHZ00@nwk-avmta-1.sfbay.Sun.COM>; Mon, 17 Nov 2008 11:20:19 -0800 (PST) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAH0027HSDTN250@nwk-avmta-1.sfbay.Sun.COM>; Mon, 17 Nov 2008 11:20:18 -0800 (PST) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe3.eu.sun.com [192.18.6.10]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAHJKHKD028558; Mon, 17 Nov 2008 19:20:17 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAH00001SC0HA00@fe-emea-09.sun.com> (original mail from James.Gates@Sun.COM); Mon, 17 Nov 2008 19:20:17 +0000 (GMT) Received: from [192.168.1.100] ([129.150.65.20]) by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAH001PISDAD8E0@fe-emea-09.sun.com>; Mon, 17 Nov 2008 19:20:17 +0000 (GMT) Date: Mon, 17 Nov 2008 14:19:06 -0500 From: James Gates Subject: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] Sender: James.Gates@sun.com To: psarc-ext@sun.com Cc: Mayuresh Nirhali , lsarc-ext@sun.com Message-id: <4921C3AA.3000104@sun.com> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_C9SxjQxeyzYnk8t2ZfovYw)" X-PMX-Version: 5.4.1.325704 User-Agent: Thunderbird 2.0.0.16 (X11/20080807) Status: RO Content-Length: 27305 This is a multi-part message in MIME format. --Boundary_(ID_C9SxjQxeyzYnk8t2ZfovYw) Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT I'm sponsoring this fast track case on behalf of Mayuresh Nirhali. The timer is set for 25th Nov. This case was originally submitted on the 14th Oct. as LSARC/2008/632, but during review some SMF & PAM issues were raised and it was suggested that PSARC would be a better committee to address these issues. Specifically: [1] The way dante server is implemented, it does not confirm to the recommended practice in Solaris of using the privilege mechanism. The server implementation depends on the privileged and notprivileged users configured, instead of adding and releasing privileges to the users. Does the ARC approve of such implementation to be integrated into Solaris? [2] Dante server uses Solaris PAM for authentication which requires the privileged user to be 'root'. Hence, the privileged user (i.e. root) will have all the privileges even when not all of them are required. This is not the current recommended practice, but is this acceptable at all? -- Jim Gates Sun Microsystems Nashua, NH, USA http://sun.com/postgresql --Boundary_(ID_C9SxjQxeyzYnk8t2ZfovYw) Content-type: text/plain; name=dante-proposal_v4.txt Content-transfer-encoding: 7BIT Content-disposition: inline; filename=dante-proposal_v4.txt 1.0 Project Information 1.1 Name of project/component Dante: A Socks server and client implementation 1.2 Author of document Mayuresh Nirhali 2.0 Project Summary 2.1 Project Description Dante is a circuit-level firewall/proxy that can be used to provide convenient and secure network connectivity to a wide range of hosts while requiring only the server Dante runs on to have external network connectivity. 2.2 Release binding What is is the release binding? (see http://opensolaris.org/os/community/arc/policies/release-taxonomy/) [ ] Major [X] Minor [ ] Patch or Micro [ ] Unknown -- ARC review required 2.3 Type of project Is this case a Linux Familiarity project? [X] Yes [ ] No 2.4 Originating Community 2.4.1 Community Name http://www.inet.no/dante/ 2.4.2 Community Involvement Indicate Sun's involvement in the community [ ] Maintainer [ ] Contributor [X] Monitoring Will the project team work with the upstream community to resolve architectural issues of interest to Sun? [X] Yes [ ] No - briefly explain Will we or are we forking from the community? [ ] Yes - ARC review required prior to forking [X] No 3.0 Technical Description 3.1 Installation & Sharable 3.1.1S Solaris Installation - section only required for Solaris Software (see http://opensolaris.org/os/community/arc/policies/install-locations/ for details) Does this project follow the Install Locations best practice? [X] Yes [ ] No - ARC review required Does this project install into /usr under [sbin|bin|lib|include|man|share]? [X] Yes [ ] No or N/A Does this project install into /opt? [ ] Yes - explain below [X] No or N/A Does this project install into a different directory structure? [ ] Yes - ARC review required [X] No or N/A Do any of the components of this project conflict with anything under /usr? (see http://opensolaris.org/os/community/arc/caselog/2007/047/ for details) [ ] Yes - explain below [X] No If conflicts exist then will this project install under /usr/gnu? [ ] Yes [ ] No - ARC review required [X] N/A Is this project installing into /usr/sfw? [ ] Yes - ARC review required [X] No 3.2 Exported Libraries Are libraries being delivered by this project? [X] Yes [ ] No - continue with next section (section 3.3) Are 64-bit versions of the libraries being delivered? [X] Yes [ ] No - ARC review required Are static versions of the libraries being delivered? [ ] Yes - ARC review required [X] No 3.3 Services and the /etc Directory (see http://opensolaris.org/os/community/arc/policies/SMF-policy/) Does the project integrate anything into /etc/init.d or /etc/rc?.d? [ ] Yes - ARC review required [X] No Does the project integrate any new entries into /etc/inittab or /etc/inetd.conf? [ ] Yes - ARC review required [X] No Does the project integrate any private non-public files into /etc/default or /etc/ configuration files? [ ] Yes - ARC review required [X] No Does the service manifests method context grant rights above that of the noaccess user and basic privilege set? [ ] Yes - ARC review required [X] No 3.4 Security 3.4.1 Secure By Default (see http://opensolaris.org/os/community/arc/policies/secure-by-default/ for details) (see http://www.opensolaris.org/os/community/arc/policies/NITS-policy/ for details) (see parts of http://opensolaris.org/os/community/arc/policies/SMF-policy/ for addtional details) Are there any network services provided by this project? [X] Yes [ ] No - continue with the next section (section 3.4.2) Are network services enabled by default? [ ] Yes - ARC review required [X] No [ ] N/A Are network services automatically enabled by the project during installation? [ ] Yes - ARC review required [X] No [ ] N/A Are inbound network communications denied by default? [ ] Yes [ ] No - ARC review required [X] N/A Is inbound data checked to prevent content-based attacks? [ ] Yes [ ] No - ARC review required [X] N/A Is the outbound receiver authenticated? [ ] Yes [ ] No - ARC review required [X] N/A Is the receiver authenticated prior to receiving any sensitive outbound communication? [ ] Yes [ ] No - ARC review required [X] N/A 3.4.2 Authorization (see http://opensolaris.org/os/community/arc/bestpractices/rbac-intro/ and http://opensolaris.org/os/community/arc/bestpractices/rbac-profiles/ and http://opensolaris.org/os/community/arc/bestpractices/rbac-profiles/ for details) Are there any setuid/setgid privileged binaries in the project? [ ] Yes - ARC review required [X] No - continue with next section (section 3.4.3) If yes then are the setuid/setgid privileges handled by the use of roles? [ ] Yes [ ] No - ARC review required 3.4.3 Auditing (see http://opensolaris.org/os/community/arc/policies/audit-policy/ for details) (see http://opensolaris.org/os/community/arc/caselog/2003/397 for details) Does this component contain administrative or security enforcing software? [X] Yes - ARC review required [ ] No - continue to next section (section 3.4.4) (see http://opensolaris.org/os/community/arc/caselog/2003/397 for details) Do the components create audit logs detailing what took place including what event took place, who was involved, when the event took place? [ ] Yes - ARC contract and Audit project team review required [X] No - ARC review required 3.4.4 Authentication (see http://opensolaris.org/os/community/arc/policies/PAM/) Do the components contain any authentication code? [X] Yes [ ] No - continue to next section (section 3.4.5) If yes do the components use PAM (plugable authentication modules) for authentication? [X] Yes [ ] No - ARC review required If yes is a single PAM session maintained during authentication? [X] Yes [ ] No - ARC review required If yes are the components sufficiently privileged to allow the requested operations (authentication, password change, process credential manipulation, audit state initialization)? [X] Yes - briefly describe below [ ] No - ARC review required Dante uses PAM only for authentication and acquires sufficient privileges before calling pam operations. 3.4.5 Passwords (see http://opensolaris.org/os/community/arc/bestpractices/passwords-cli/ and http://opensolaris.org/os/community/arc/bestpractices/passwords-files/ for details) Do any of the components for the project deal with passwords? [X] Yes [ ] No - continue to next section (section 3.4.6) If yes are these passwords entered via the CLI or environment? [X] Yes - ARC review required [ ] No passwords are entered via CLI. Are passwords stored within the file system for the component? [ ] Yes [X] No - continue to next section (section 3.4.6) dante can work with SOCKS_USERNAME & SOCKS_PASSWORD variables if set in the environment. If yes are the permissions on the file such to protect exposing the password(s)? [ ] Yes [ ] No - ARC review required 3.4.6 General Security Questions (see http://opensolaris.org/os/community/arc/bestpractices/security-questions/ for details) Are there any network protocols used by this project? [X] Yes [ ] No - continue with the next section (section 3.5) Do the components use standard network protocols? [X] Yes [ ] No - ARC review required Do network services for the project make decisions based upon user, host or service identities? [X] Yes - explain below [ ] No [ ] N/A Dante, like a typical Socks server, authenticates users based on various methods like, PAM, username etc. dante also makes routing decisions based on the hosts configured in the socks.conf sample file. Do the components make use of secret information during authentication and/or authorization? [X] Yes - explain below [ ] No [ ] N/A Dante uses passwords for authentication. 3.5 Networking Do the components access the network? [X] Yes [ ] No - continue with the next section (section 3.6) If yes do the components support IPv6? [X] Yes [ ] No - ARC review required 3.6 Core Solaris Components Do the components of this project compete with or duplicate core Solaris components? [ ] Yes - ARC review required [X] No Examples of Core Solaris Components include but are not limited to: Secure By Default Authorizations PAM -- Plugable Authentication Module Privilege PRM -- Process Rights Management -- Privilege Audit xVm -- Virtualization zones / Solaris Containers PRM -- Process Rights Management RBAC -- Role Based Access Control TX / Trusted Extensions ZFS SMF -- Service Management Facility FMA -- Fault Management Architecture SCF -- Smart Card Facility IPsec 4.0 Interfaces (see http://www.opensolaris.org/os/community/arc/policies/interface-taxonomy/ for details) 4.1 Exported Interfaces +----------------------------------------------------------------------------+ | | Interface Name | Classification | Comments | |----------------------------------------------------------------------------| | 1 | libdsocks.so | Project Private | SOCKS daemon library | | |---------------------+--------------------------------------------------| | 2 | libsocks.so | Committed | SOCKS library | | |---------------------+--------------------------------------------------| | 3 | socksify | Uncommitted | SOCKS client script | | |---------------------+--------------------------------------------------| | 4 | sockd | Uncommitted | SOCKS server daemon | | |---------------------+--------------------------------------------------| | 5 | socks.conf | Uncommitted | Client configuration file | | |---------------------+--------------------------------------------------| | 6 | sockd.conf | Uncommitted | Server configuration file | | |---------------------+--------------------------------------------------| | 7 | SUNWlibsocks | Public/Committed | Client package | | |---------------------+--------------------------------------------------| | 8 | SUNWdanteu | Public/Committed | Server package (User) | | |---------------------+--------------------------------------------------| | 9 | SUNWdanter | Public/Committed | Server package (Root) | | |---------------------+--------------------------------------------------| |10 | network/socks | Public/Committed | SMF Service name | | |---------------------+--------------------------------------------------| |11 | sockd | Public/Committed | PAM Servicename | +----------------------------------------------------------------------------+ 4.2 Imported Interfaces Interface Name Classification Comments --------------------------- -------------------- -------------------------- NONE --Boundary_(ID_C9SxjQxeyzYnk8t2ZfovYw) Content-type: text/plain; name=dante_onepager_v2.txt Content-transfer-encoding: 7BIT Content-disposition: inline; filename=dante_onepager_v2.txt Template Version: @(#)onepager.txt 1.35 07/11/07 SMI Copyright 2007 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Dante: A Socks server and client implementation 1.2. Name of Document Author/Supplier: Mayuresh Nirhali 1.3. Date of This Document: 08/26/2008 1.3.1. Date this project was conceived: N/A 1.4. Name of Major Document Customer(s)/Consumer(s): 1.4.1. The PAC or CPT you expect to review your project: Solaris 1.4.2. The ARC(s) you expect to review your project: PSARC 1.4.3. The Director/VP who is "Sponsoring" this project: Chris.Armes@Sun.COM 1.4.4. The name of your business unit: Solaris - RPE 1.5. Email Aliases: 1.5.1. Responsible Manager: Lukas.Rovensky@Sun.COM 1.5.2. Responsible Engineer: Mayuresh.Nirhali@Sun.COM 1.5.3. Marketing Manager: 1.5.4. Interest List: sfwnv-discuss@opensolaris.org 2. Project Summary 2.1. Project Description: Dante is a circuit-level firewall/proxy that can be used to provide convenient and secure network connectivity to a wide range of hosts while requiring only the server. Dante runs on to have external network connectivity. 2.2. Risks and Assumptions: Dante is a third party Socks server and client implementation. The current version (1.1.19) is stable and it was released in January 2006. Since then, there has been no releases of this product. Any bugs found for this product will be redirected to the owners. Considering that there seems to be no active development on this product since 2006, the bugs/issues may take longer to resolve. 2.3. SMF Dante SOCKS server will be managed as a SMF service. The Dante server would run with Least Privilege specified through the SMF manifest. It would not need to have any of the SUID/SGID bits in the file system to be set nor would the daemon itself need an RBAC entry, because SMF 'start' method would set the privileges and UID/GID as necessary for normal operation. SMF service for Dante SOCKS server will be added under network category as network/socks. The package will add the manifest file and the SMF method as below, /var/svc/manifest/network/socks.xml /lib/svc/method/socks Method credentials for dante SMF service will be "root" user and "root" group. See Section 4.11 (Security Impact) for more details. The SMF service for Dante will be disabled by default. Dante socks server reads the confirguration file when started. The configuration file requires certain parameters to be specified for the server to run (e.g. the address/interface and port for all the incoming requests). Since there cannot be any plausible default value to such parameters, the config file still needs to be used although it is not a recommended practice for SMF. The socks server will go into maintenance mode if configuration file is not updated with valid values to the necessary parameters. Hence, to enable dante server, first, the /etc/sockd.conf should be populated with valid information and then, the service should be enabled. 3. Business Summary 3.1. Problem Area: Dante provides convinient and secure network connectivity from behind a firewall using Socks protocol. Dante is a free implementation of the proxy protocols socks version 4, socks version 5 (rfc1928) and msproxy. It can be used as a firewall between networks. 3.2. Market/Requester: OpenSolaris Community 3.3. Business Justification: Integration of Dante will allow the Solaris host to act as a Socks server. Dante's client implementation allows users to connect outside their secured network in a user friendly manner. Such socks client-server implementation has been missing from Solaris. Currently, in order to have socks server/client functionality on Solaris, the users need to compile-install dante (or similar implementation) on their own. The seamless integration of Dante with other Solaris features (such as SMF) will provide better out-of-the-box usability. 3.4. Competitive Analysis: Most of the other Unix based Operating systems support Dante. The competitors in this regard are really the Operating Systems that include such functionality today. 3.5. Opportunity Window/Exposure: The third party product is ready to be integrated. 3.6. How will you know when you are done?: The product is ready to be integrated. 4. Technical Description: 4.1. Details: http://www.inet.no/dante/ Dante is a circuit-level firewall/proxy that can be used to provide convenient and secure network connectivity to a wide range of hosts while requiring only the server Dante runs on to have external network connectivity. Once installed, Dante can in most cases be made transparent to the clients while offering detailed access control and logging facilities to the server administrator. 4.2. Bug/RFE Number(s): 6661961 4.3. In Scope: 4.4. Out of Scope: 4.5. Interfaces: This integration will not modify or delete any interfaces. It will add one binary for the server (/usr/sbin/sockd) and another script for the client (/usr/bin/socksify). In addition, this package will also add 2 shared libraries as below, /usr/lib/libdsocks.so /usr/lib/libsocks.so The /usr/bin/socksify script will load the dynamic libraries mentioned above to "socksify" existing applications to become socks clients. For the server, /etc/sockd.conf will be used as a configuration file, and for the client, /etc/socks.conf will be used for configuration. This package will not import any interfaces, the exported interfaces can be summarized in the following manner, +----------------------------------------------------------------------------+ | | Interface Name | Classification | Comments | |----------------------------------------------------------------------------| | 1 | libdsocks.so | Project Private | SOCKS daemon library | | |---------------------+--------------------------------------------------| | 2 | libsocks.so | Committed | SOCKS library | | |---------------------+--------------------------------------------------| | 3 | socksify | Uncommitted | SOCKS client script | | |---------------------+--------------------------------------------------| | 4 | sockd | Uncommitted | SOCKS server daemon | | |---------------------+--------------------------------------------------| | 5 | socks.conf | Uncommitted | Client configuration file | | |---------------------+--------------------------------------------------| | 6 | sockd.conf | Uncommitted | Server configuration file | | |---------------------+--------------------------------------------------| | 7 | SUNWlibsocks | Public/Committed | Client package | | |---------------------+--------------------------------------------------| | 8 | SUNWdanteu | Public/Committed | Server package (User) | | |---------------------+--------------------------------------------------| | 9 | SUNWdanter | Public/Committed | Server package (Root) | | |---------------------+--------------------------------------------------| |10 | network/socks | Public/Committed | SMF Service name | | |---------------------+--------------------------------------------------| |11 | sockd | Public/Committed | PAM Servicename | +----------------------------------------------------------------------------+ 4.6. Doc Impact: This integration will correctly add man entries. None of the existing man entries will be touched. The new man entries are as below, /usr/man/man1m/sockd.1m /usr/man/man1/socksify.1 /usr/man/man4/sockd.conf.5 /usr/man/man4/socks.conf.5 4.7. Admin/Config Impact: The package will also provide template of configuration files for both server and client. The templates for these configureation files are attached. /etc/sockd.conf /etc/socks.conf 4.8. HA Impact: N/A 4.9. I18N/L10N Impact: None. The error messages are not localized. 4.10. Packaging & Delivery: Both server and client will be installed with following packages. SUNWlibsocks Dante - A Socks client implementation SUNWdanter Dante - A Socks server implementation, Root SUNWdanteu Dante - A Socks server implementation, User 4.11. Security Impact: Socks Server and client will depend on the port configured in the respective configuration file for network connectivity. The server configuration file defines two variables as, user.privileged and user.notprivileged. These 2 variables can have a list of userids separated by comma. The server implementation calls seteuid function to switch between privileged and notprivileged users. Upon start, the server switches the effective id from the user who started the binary to the specified user.notprivileged. Later, for all the privileged operations (e.g. PAM authentication), the server sets the effective user ID from user.notprivileged to specified user.privileged by calling seteuid function. The behavior as described above is not a recommended practice with Solaris. Instead of switching between user IDs for privileged and non-privileged operations, Solaris recommends to acquire and release specific privileges for such privileged actions which provide better and fine grained control. However, the dante server implementation does not use the privilege mechanism and depends on the 2 users defined in the configuration file. The default/sample configuration file will have user.notprivileged as 'daemon' and the user.privileged will be set to 'root'. The reason why user.privileged need to be root is because pam_authenticate(3pam) requires all privileges and user ID as 0. By default, Dante server will use port 1080, the port can be configured in /etc/sockd.conf file. Please note that if a reserved port is configured then the dante server will bind to it successfully, as the user.privileged is set to 'root'. 4.11.1 PAM Authentication Dante server confirms to the PAM policy specified for the User Identification and Authentication. During authentication, the server makes calls to following functions in order, pam_start() pam_set_item() pam_authenticate() pam_acct_mgmt() pam_end() Please note that before starting the pam authentication, dante server calls seteuid() to switch to the specified privileged user. In Solaris, PAM requires all privileges and user ID 0 and hence it is necessary that user.privileged should be set to 'root' in the /etc/sockd.conf file. 4.12. Dependencies: The socks server mainly depends on the available support for PAM. The details of dependencies are as below, bash-3.00# ldd libsocks.so libpam.so.1 => /lib/libpam.so.1 libsocket.so.1 => /lib/libsocket.so.1 libnsl.so.1 => /lib/libnsl.so.1 libresolv.so.2 => /lib/libresolv.so.2 libc.so.1 => /lib/libc.so.1 libmp.so.2 => /lib/libmp.so.2 libmd.so.1 => /lib/libmd.so.1 libscf.so.1 => /lib/libscf.so.1 libuutil.so.1 => /lib/libuutil.so.1 libgen.so.1 => /lib/libgen.so.1 libm.so.2 => /lib/libm.so.2 The output of ldd command for libdsocks.so shows exactly the same output as above. bash-3.00# ldd /usr/sbin/sockd libwrap.so.1 => /usr/lib/libwrap.so.1 libpam.so.1 => /lib/libpam.so.1 libsocket.so.1 => /lib/libsocket.so.1 libnsl.so.1 => /lib/libnsl.so.1 libresolv.so.2 => /lib/libresolv.so.2 libc.so.1 => /lib/libc.so.1 libmp.so.2 => /lib/libmp.so.2 libmd.so.1 => /lib/libmd.so.1 libscf.so.1 => /lib/libscf.so.1 libuutil.so.1 => /lib/libuutil.so.1 libgen.so.1 => /lib/libgen.so.1 libm.so.2 => /lib/libm.so.2 The SMF service for Dante server does not depend on any other specific service. 5. Reference Documents: http://www.inet.no/dante/ 6. Resources and Schedule: 6.1. Projected Availability: Integration targeted for Indiana release. 6.2. Cost of Effort: Minimum. One resource for integration in SFW consolidation. 6.3. Cost of Capital Resources: None 6.4. Product Approval Committee requested information: 6.4.1. Consolidation or Component Name: SFW 6.4.3. Type of CPT Review and Approval expected: FASTTRACK 6.4.4. Project Boundary Conditions: None 6.4.5. Is this a necessary project for OEM agreements: No 6.4.6. Notes: 6.4.7. Target RTI Date/Release: Indiana Release 6.4.8. Target Code Design Review Date: 6.4.9. Update approval addition: 6.5. ARC review type: FastTrack 6.6. ARC Exposure: OPEN 6.6.1. Rationale: 7. Prototype Availability: 7.1. Prototype Availability: N/A 7.2. Prototype Cost: N/A --Boundary_(ID_C9SxjQxeyzYnk8t2ZfovYw)-- From James.Gates@sun.com Mon Nov 17 11:20:22 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAHJKLpE018886; Mon, 17 Nov 2008 11:20:21 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mAHJKIBn019008; Mon, 17 Nov 2008 19:20:20 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAH00903SDVHZ00@nwk-avmta-1.sfbay.Sun.COM>; Mon, 17 Nov 2008 11:20:19 -0800 (PST) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAH0027HSDTN250@nwk-avmta-1.sfbay.Sun.COM>; Mon, 17 Nov 2008 11:20:18 -0800 (PST) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe3.eu.sun.com [192.18.6.10]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAHJKHKD028558; Mon, 17 Nov 2008 19:20:17 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAH00001SC0HA00@fe-emea-09.sun.com> (original mail from James.Gates@Sun.COM); Mon, 17 Nov 2008 19:20:17 +0000 (GMT) Received: from [192.168.1.100] ([129.150.65.20]) by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAH001PISDAD8E0@fe-emea-09.sun.com>; Mon, 17 Nov 2008 19:20:17 +0000 (GMT) Date: Mon, 17 Nov 2008 14:19:06 -0500 From: James Gates Subject: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] Sender: James.Gates@sun.com To: psarc-ext@sun.com Cc: Mayuresh Nirhali , lsarc-ext@sun.com Message-id: <4921C3AA.3000104@sun.com> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_C9SxjQxeyzYnk8t2ZfovYw)" X-PMX-Version: 5.4.1.325704 User-Agent: Thunderbird 2.0.0.16 (X11/20080807) Status: RO Content-Length: 27305 This is a multi-part message in MIME format. --Boundary_(ID_C9SxjQxeyzYnk8t2ZfovYw) Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT I'm sponsoring this fast track case on behalf of Mayuresh Nirhali. The timer is set for 25th Nov. This case was originally submitted on the 14th Oct. as LSARC/2008/632, but during review some SMF & PAM issues were raised and it was suggested that PSARC would be a better committee to address these issues. Specifically: [1] The way dante server is implemented, it does not confirm to the recommended practice in Solaris of using the privilege mechanism. The server implementation depends on the privileged and notprivileged users configured, instead of adding and releasing privileges to the users. Does the ARC approve of such implementation to be integrated into Solaris? [2] Dante server uses Solaris PAM for authentication which requires the privileged user to be 'root'. Hence, the privileged user (i.e. root) will have all the privileges even when not all of them are required. This is not the current recommended practice, but is this acceptable at all? -- Jim Gates Sun Microsystems Nashua, NH, USA http://sun.com/postgresql --Boundary_(ID_C9SxjQxeyzYnk8t2ZfovYw) Content-type: text/plain; name=dante-proposal_v4.txt Content-transfer-encoding: 7BIT Content-disposition: inline; filename=dante-proposal_v4.txt 1.0 Project Information 1.1 Name of project/component Dante: A Socks server and client implementation 1.2 Author of document Mayuresh Nirhali 2.0 Project Summary 2.1 Project Description Dante is a circuit-level firewall/proxy that can be used to provide convenient and secure network connectivity to a wide range of hosts while requiring only the server Dante runs on to have external network connectivity. 2.2 Release binding What is is the release binding? (see http://opensolaris.org/os/community/arc/policies/release-taxonomy/) [ ] Major [X] Minor [ ] Patch or Micro [ ] Unknown -- ARC review required 2.3 Type of project Is this case a Linux Familiarity project? [X] Yes [ ] No 2.4 Originating Community 2.4.1 Community Name http://www.inet.no/dante/ 2.4.2 Community Involvement Indicate Sun's involvement in the community [ ] Maintainer [ ] Contributor [X] Monitoring Will the project team work with the upstream community to resolve architectural issues of interest to Sun? [X] Yes [ ] No - briefly explain Will we or are we forking from the community? [ ] Yes - ARC review required prior to forking [X] No 3.0 Technical Description 3.1 Installation & Sharable 3.1.1S Solaris Installation - section only required for Solaris Software (see http://opensolaris.org/os/community/arc/policies/install-locations/ for details) Does this project follow the Install Locations best practice? [X] Yes [ ] No - ARC review required Does this project install into /usr under [sbin|bin|lib|include|man|share]? [X] Yes [ ] No or N/A Does this project install into /opt? [ ] Yes - explain below [X] No or N/A Does this project install into a different directory structure? [ ] Yes - ARC review required [X] No or N/A Do any of the components of this project conflict with anything under /usr? (see http://opensolaris.org/os/community/arc/caselog/2007/047/ for details) [ ] Yes - explain below [X] No If conflicts exist then will this project install under /usr/gnu? [ ] Yes [ ] No - ARC review required [X] N/A Is this project installing into /usr/sfw? [ ] Yes - ARC review required [X] No 3.2 Exported Libraries Are libraries being delivered by this project? [X] Yes [ ] No - continue with next section (section 3.3) Are 64-bit versions of the libraries being delivered? [X] Yes [ ] No - ARC review required Are static versions of the libraries being delivered? [ ] Yes - ARC review required [X] No 3.3 Services and the /etc Directory (see http://opensolaris.org/os/community/arc/policies/SMF-policy/) Does the project integrate anything into /etc/init.d or /etc/rc?.d? [ ] Yes - ARC review required [X] No Does the project integrate any new entries into /etc/inittab or /etc/inetd.conf? [ ] Yes - ARC review required [X] No Does the project integrate any private non-public files into /etc/default or /etc/ configuration files? [ ] Yes - ARC review required [X] No Does the service manifests method context grant rights above that of the noaccess user and basic privilege set? [ ] Yes - ARC review required [X] No 3.4 Security 3.4.1 Secure By Default (see http://opensolaris.org/os/community/arc/policies/secure-by-default/ for details) (see http://www.opensolaris.org/os/community/arc/policies/NITS-policy/ for details) (see parts of http://opensolaris.org/os/community/arc/policies/SMF-policy/ for addtional details) Are there any network services provided by this project? [X] Yes [ ] No - continue with the next section (section 3.4.2) Are network services enabled by default? [ ] Yes - ARC review required [X] No [ ] N/A Are network services automatically enabled by the project during installation? [ ] Yes - ARC review required [X] No [ ] N/A Are inbound network communications denied by default? [ ] Yes [ ] No - ARC review required [X] N/A Is inbound data checked to prevent content-based attacks? [ ] Yes [ ] No - ARC review required [X] N/A Is the outbound receiver authenticated? [ ] Yes [ ] No - ARC review required [X] N/A Is the receiver authenticated prior to receiving any sensitive outbound communication? [ ] Yes [ ] No - ARC review required [X] N/A 3.4.2 Authorization (see http://opensolaris.org/os/community/arc/bestpractices/rbac-intro/ and http://opensolaris.org/os/community/arc/bestpractices/rbac-profiles/ and http://opensolaris.org/os/community/arc/bestpractices/rbac-profiles/ for details) Are there any setuid/setgid privileged binaries in the project? [ ] Yes - ARC review required [X] No - continue with next section (section 3.4.3) If yes then are the setuid/setgid privileges handled by the use of roles? [ ] Yes [ ] No - ARC review required 3.4.3 Auditing (see http://opensolaris.org/os/community/arc/policies/audit-policy/ for details) (see http://opensolaris.org/os/community/arc/caselog/2003/397 for details) Does this component contain administrative or security enforcing software? [X] Yes - ARC review required [ ] No - continue to next section (section 3.4.4) (see http://opensolaris.org/os/community/arc/caselog/2003/397 for details) Do the components create audit logs detailing what took place including what event took place, who was involved, when the event took place? [ ] Yes - ARC contract and Audit project team review required [X] No - ARC review required 3.4.4 Authentication (see http://opensolaris.org/os/community/arc/policies/PAM/) Do the components contain any authentication code? [X] Yes [ ] No - continue to next section (section 3.4.5) If yes do the components use PAM (plugable authentication modules) for authentication? [X] Yes [ ] No - ARC review required If yes is a single PAM session maintained during authentication? [X] Yes [ ] No - ARC review required If yes are the components sufficiently privileged to allow the requested operations (authentication, password change, process credential manipulation, audit state initialization)? [X] Yes - briefly describe below [ ] No - ARC review required Dante uses PAM only for authentication and acquires sufficient privileges before calling pam operations. 3.4.5 Passwords (see http://opensolaris.org/os/community/arc/bestpractices/passwords-cli/ and http://opensolaris.org/os/community/arc/bestpractices/passwords-files/ for details) Do any of the components for the project deal with passwords? [X] Yes [ ] No - continue to next section (section 3.4.6) If yes are these passwords entered via the CLI or environment? [X] Yes - ARC review required [ ] No passwords are entered via CLI. Are passwords stored within the file system for the component? [ ] Yes [X] No - continue to next section (section 3.4.6) dante can work with SOCKS_USERNAME & SOCKS_PASSWORD variables if set in the environment. If yes are the permissions on the file such to protect exposing the password(s)? [ ] Yes [ ] No - ARC review required 3.4.6 General Security Questions (see http://opensolaris.org/os/community/arc/bestpractices/security-questions/ for details) Are there any network protocols used by this project? [X] Yes [ ] No - continue with the next section (section 3.5) Do the components use standard network protocols? [X] Yes [ ] No - ARC review required Do network services for the project make decisions based upon user, host or service identities? [X] Yes - explain below [ ] No [ ] N/A Dante, like a typical Socks server, authenticates users based on various methods like, PAM, username etc. dante also makes routing decisions based on the hosts configured in the socks.conf sample file. Do the components make use of secret information during authentication and/or authorization? [X] Yes - explain below [ ] No [ ] N/A Dante uses passwords for authentication. 3.5 Networking Do the components access the network? [X] Yes [ ] No - continue with the next section (section 3.6) If yes do the components support IPv6? [X] Yes [ ] No - ARC review required 3.6 Core Solaris Components Do the components of this project compete with or duplicate core Solaris components? [ ] Yes - ARC review required [X] No Examples of Core Solaris Components include but are not limited to: Secure By Default Authorizations PAM -- Plugable Authentication Module Privilege PRM -- Process Rights Management -- Privilege Audit xVm -- Virtualization zones / Solaris Containers PRM -- Process Rights Management RBAC -- Role Based Access Control TX / Trusted Extensions ZFS SMF -- Service Management Facility FMA -- Fault Management Architecture SCF -- Smart Card Facility IPsec 4.0 Interfaces (see http://www.opensolaris.org/os/community/arc/policies/interface-taxonomy/ for details) 4.1 Exported Interfaces +----------------------------------------------------------------------------+ | | Interface Name | Classification | Comments | |----------------------------------------------------------------------------| | 1 | libdsocks.so | Project Private | SOCKS daemon library | | |---------------------+--------------------------------------------------| | 2 | libsocks.so | Committed | SOCKS library | | |---------------------+--------------------------------------------------| | 3 | socksify | Uncommitted | SOCKS client script | | |---------------------+--------------------------------------------------| | 4 | sockd | Uncommitted | SOCKS server daemon | | |---------------------+--------------------------------------------------| | 5 | socks.conf | Uncommitted | Client configuration file | | |---------------------+--------------------------------------------------| | 6 | sockd.conf | Uncommitted | Server configuration file | | |---------------------+--------------------------------------------------| | 7 | SUNWlibsocks | Public/Committed | Client package | | |---------------------+--------------------------------------------------| | 8 | SUNWdanteu | Public/Committed | Server package (User) | | |---------------------+--------------------------------------------------| | 9 | SUNWdanter | Public/Committed | Server package (Root) | | |---------------------+--------------------------------------------------| |10 | network/socks | Public/Committed | SMF Service name | | |---------------------+--------------------------------------------------| |11 | sockd | Public/Committed | PAM Servicename | +----------------------------------------------------------------------------+ 4.2 Imported Interfaces Interface Name Classification Comments --------------------------- -------------------- -------------------------- NONE --Boundary_(ID_C9SxjQxeyzYnk8t2ZfovYw) Content-type: text/plain; name=dante_onepager_v2.txt Content-transfer-encoding: 7BIT Content-disposition: inline; filename=dante_onepager_v2.txt Template Version: @(#)onepager.txt 1.35 07/11/07 SMI Copyright 2007 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Dante: A Socks server and client implementation 1.2. Name of Document Author/Supplier: Mayuresh Nirhali 1.3. Date of This Document: 08/26/2008 1.3.1. Date this project was conceived: N/A 1.4. Name of Major Document Customer(s)/Consumer(s): 1.4.1. The PAC or CPT you expect to review your project: Solaris 1.4.2. The ARC(s) you expect to review your project: PSARC 1.4.3. The Director/VP who is "Sponsoring" this project: Chris.Armes@Sun.COM 1.4.4. The name of your business unit: Solaris - RPE 1.5. Email Aliases: 1.5.1. Responsible Manager: Lukas.Rovensky@Sun.COM 1.5.2. Responsible Engineer: Mayuresh.Nirhali@Sun.COM 1.5.3. Marketing Manager: 1.5.4. Interest List: sfwnv-discuss@opensolaris.org 2. Project Summary 2.1. Project Description: Dante is a circuit-level firewall/proxy that can be used to provide convenient and secure network connectivity to a wide range of hosts while requiring only the server. Dante runs on to have external network connectivity. 2.2. Risks and Assumptions: Dante is a third party Socks server and client implementation. The current version (1.1.19) is stable and it was released in January 2006. Since then, there has been no releases of this product. Any bugs found for this product will be redirected to the owners. Considering that there seems to be no active development on this product since 2006, the bugs/issues may take longer to resolve. 2.3. SMF Dante SOCKS server will be managed as a SMF service. The Dante server would run with Least Privilege specified through the SMF manifest. It would not need to have any of the SUID/SGID bits in the file system to be set nor would the daemon itself need an RBAC entry, because SMF 'start' method would set the privileges and UID/GID as necessary for normal operation. SMF service for Dante SOCKS server will be added under network category as network/socks. The package will add the manifest file and the SMF method as below, /var/svc/manifest/network/socks.xml /lib/svc/method/socks Method credentials for dante SMF service will be "root" user and "root" group. See Section 4.11 (Security Impact) for more details. The SMF service for Dante will be disabled by default. Dante socks server reads the confirguration file when started. The configuration file requires certain parameters to be specified for the server to run (e.g. the address/interface and port for all the incoming requests). Since there cannot be any plausible default value to such parameters, the config file still needs to be used although it is not a recommended practice for SMF. The socks server will go into maintenance mode if configuration file is not updated with valid values to the necessary parameters. Hence, to enable dante server, first, the /etc/sockd.conf should be populated with valid information and then, the service should be enabled. 3. Business Summary 3.1. Problem Area: Dante provides convinient and secure network connectivity from behind a firewall using Socks protocol. Dante is a free implementation of the proxy protocols socks version 4, socks version 5 (rfc1928) and msproxy. It can be used as a firewall between networks. 3.2. Market/Requester: OpenSolaris Community 3.3. Business Justification: Integration of Dante will allow the Solaris host to act as a Socks server. Dante's client implementation allows users to connect outside their secured network in a user friendly manner. Such socks client-server implementation has been missing from Solaris. Currently, in order to have socks server/client functionality on Solaris, the users need to compile-install dante (or similar implementation) on their own. The seamless integration of Dante with other Solaris features (such as SMF) will provide better out-of-the-box usability. 3.4. Competitive Analysis: Most of the other Unix based Operating systems support Dante. The competitors in this regard are really the Operating Systems that include such functionality today. 3.5. Opportunity Window/Exposure: The third party product is ready to be integrated. 3.6. How will you know when you are done?: The product is ready to be integrated. 4. Technical Description: 4.1. Details: http://www.inet.no/dante/ Dante is a circuit-level firewall/proxy that can be used to provide convenient and secure network connectivity to a wide range of hosts while requiring only the server Dante runs on to have external network connectivity. Once installed, Dante can in most cases be made transparent to the clients while offering detailed access control and logging facilities to the server administrator. 4.2. Bug/RFE Number(s): 6661961 4.3. In Scope: 4.4. Out of Scope: 4.5. Interfaces: This integration will not modify or delete any interfaces. It will add one binary for the server (/usr/sbin/sockd) and another script for the client (/usr/bin/socksify). In addition, this package will also add 2 shared libraries as below, /usr/lib/libdsocks.so /usr/lib/libsocks.so The /usr/bin/socksify script will load the dynamic libraries mentioned above to "socksify" existing applications to become socks clients. For the server, /etc/sockd.conf will be used as a configuration file, and for the client, /etc/socks.conf will be used for configuration. This package will not import any interfaces, the exported interfaces can be summarized in the following manner, +----------------------------------------------------------------------------+ | | Interface Name | Classification | Comments | |----------------------------------------------------------------------------| | 1 | libdsocks.so | Project Private | SOCKS daemon library | | |---------------------+--------------------------------------------------| | 2 | libsocks.so | Committed | SOCKS library | | |---------------------+--------------------------------------------------| | 3 | socksify | Uncommitted | SOCKS client script | | |---------------------+--------------------------------------------------| | 4 | sockd | Uncommitted | SOCKS server daemon | | |---------------------+--------------------------------------------------| | 5 | socks.conf | Uncommitted | Client configuration file | | |---------------------+--------------------------------------------------| | 6 | sockd.conf | Uncommitted | Server configuration file | | |---------------------+--------------------------------------------------| | 7 | SUNWlibsocks | Public/Committed | Client package | | |---------------------+--------------------------------------------------| | 8 | SUNWdanteu | Public/Committed | Server package (User) | | |---------------------+--------------------------------------------------| | 9 | SUNWdanter | Public/Committed | Server package (Root) | | |---------------------+--------------------------------------------------| |10 | network/socks | Public/Committed | SMF Service name | | |---------------------+--------------------------------------------------| |11 | sockd | Public/Committed | PAM Servicename | +----------------------------------------------------------------------------+ 4.6. Doc Impact: This integration will correctly add man entries. None of the existing man entries will be touched. The new man entries are as below, /usr/man/man1m/sockd.1m /usr/man/man1/socksify.1 /usr/man/man4/sockd.conf.5 /usr/man/man4/socks.conf.5 4.7. Admin/Config Impact: The package will also provide template of configuration files for both server and client. The templates for these configureation files are attached. /etc/sockd.conf /etc/socks.conf 4.8. HA Impact: N/A 4.9. I18N/L10N Impact: None. The error messages are not localized. 4.10. Packaging & Delivery: Both server and client will be installed with following packages. SUNWlibsocks Dante - A Socks client implementation SUNWdanter Dante - A Socks server implementation, Root SUNWdanteu Dante - A Socks server implementation, User 4.11. Security Impact: Socks Server and client will depend on the port configured in the respective configuration file for network connectivity. The server configuration file defines two variables as, user.privileged and user.notprivileged. These 2 variables can have a list of userids separated by comma. The server implementation calls seteuid function to switch between privileged and notprivileged users. Upon start, the server switches the effective id from the user who started the binary to the specified user.notprivileged. Later, for all the privileged operations (e.g. PAM authentication), the server sets the effective user ID from user.notprivileged to specified user.privileged by calling seteuid function. The behavior as described above is not a recommended practice with Solaris. Instead of switching between user IDs for privileged and non-privileged operations, Solaris recommends to acquire and release specific privileges for such privileged actions which provide better and fine grained control. However, the dante server implementation does not use the privilege mechanism and depends on the 2 users defined in the configuration file. The default/sample configuration file will have user.notprivileged as 'daemon' and the user.privileged will be set to 'root'. The reason why user.privileged need to be root is because pam_authenticate(3pam) requires all privileges and user ID as 0. By default, Dante server will use port 1080, the port can be configured in /etc/sockd.conf file. Please note that if a reserved port is configured then the dante server will bind to it successfully, as the user.privileged is set to 'root'. 4.11.1 PAM Authentication Dante server confirms to the PAM policy specified for the User Identification and Authentication. During authentication, the server makes calls to following functions in order, pam_start() pam_set_item() pam_authenticate() pam_acct_mgmt() pam_end() Please note that before starting the pam authentication, dante server calls seteuid() to switch to the specified privileged user. In Solaris, PAM requires all privileges and user ID 0 and hence it is necessary that user.privileged should be set to 'root' in the /etc/sockd.conf file. 4.12. Dependencies: The socks server mainly depends on the available support for PAM. The details of dependencies are as below, bash-3.00# ldd libsocks.so libpam.so.1 => /lib/libpam.so.1 libsocket.so.1 => /lib/libsocket.so.1 libnsl.so.1 => /lib/libnsl.so.1 libresolv.so.2 => /lib/libresolv.so.2 libc.so.1 => /lib/libc.so.1 libmp.so.2 => /lib/libmp.so.2 libmd.so.1 => /lib/libmd.so.1 libscf.so.1 => /lib/libscf.so.1 libuutil.so.1 => /lib/libuutil.so.1 libgen.so.1 => /lib/libgen.so.1 libm.so.2 => /lib/libm.so.2 The output of ldd command for libdsocks.so shows exactly the same output as above. bash-3.00# ldd /usr/sbin/sockd libwrap.so.1 => /usr/lib/libwrap.so.1 libpam.so.1 => /lib/libpam.so.1 libsocket.so.1 => /lib/libsocket.so.1 libnsl.so.1 => /lib/libnsl.so.1 libresolv.so.2 => /lib/libresolv.so.2 libc.so.1 => /lib/libc.so.1 libmp.so.2 => /lib/libmp.so.2 libmd.so.1 => /lib/libmd.so.1 libscf.so.1 => /lib/libscf.so.1 libuutil.so.1 => /lib/libuutil.so.1 libgen.so.1 => /lib/libgen.so.1 libm.so.2 => /lib/libm.so.2 The SMF service for Dante server does not depend on any other specific service. 5. Reference Documents: http://www.inet.no/dante/ 6. Resources and Schedule: 6.1. Projected Availability: Integration targeted for Indiana release. 6.2. Cost of Effort: Minimum. One resource for integration in SFW consolidation. 6.3. Cost of Capital Resources: None 6.4. Product Approval Committee requested information: 6.4.1. Consolidation or Component Name: SFW 6.4.3. Type of CPT Review and Approval expected: FASTTRACK 6.4.4. Project Boundary Conditions: None 6.4.5. Is this a necessary project for OEM agreements: No 6.4.6. Notes: 6.4.7. Target RTI Date/Release: Indiana Release 6.4.8. Target Code Design Review Date: 6.4.9. Update approval addition: 6.5. ARC review type: FastTrack 6.6. ARC Exposure: OPEN 6.6.1. Rationale: 7. Prototype Availability: 7.1. Prototype Availability: N/A 7.2. Prototype Cost: N/A --Boundary_(ID_C9SxjQxeyzYnk8t2ZfovYw)-- From Joep.Vesseur@Sun.COM Tue Nov 18 00:36:41 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAI8afUW017309; Tue, 18 Nov 2008 00:36:41 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAI8aeBf012926; Tue, 18 Nov 2008 00:36:40 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAI0070HT94YO00@nwk-avmta-2.sfbay.sun.com>; Tue, 18 Nov 2008 00:36:40 -0800 (PST) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAI0064AT92NP20@nwk-avmta-2.sfbay.sun.com>; Tue, 18 Nov 2008 00:36:39 -0800 (PST) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe3.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAI8aaGM026846; Tue, 18 Nov 2008 08:36:38 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAI00K01T4QI300@fe-emea-09.sun.com> (original mail from Joep.Vesseur@Sun.COM); Tue, 18 Nov 2008 08:36:36 +0000 (GMT) Received: from [10.16.117.32] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAI008AMT8ING40@fe-emea-09.sun.com>; Tue, 18 Nov 2008 08:36:18 +0000 (GMT) Date: Tue, 18 Nov 2008 09:36:17 +0100 From: Joep Vesseur Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <4921C3AA.3000104@sun.com> Sender: Joep.Vesseur@Sun.COM To: James Gates Cc: psarc-ext@Sun.COM, Mayuresh Nirhali , lsarc-ext@Sun.COM Message-id: <49227E81.2080102@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <4921C3AA.3000104@sun.com> User-Agent: Thunderbird 2.0.0.17 (X11/20081014) Status: RO Content-Length: 1355 On 11/17/08 20:19, James Gates wrote: > [1] The way dante server is implemented, it does not confirm to the > recommended practice in Solaris of using the privilege mechanism. The > server implementation depends on the privileged and notprivileged users > configured, instead of adding and releasing privileges to the users. > Does the ARC approve of such implementation to be integrated into Solaris? > > [2] Dante server uses Solaris PAM for authentication which requires the > privileged user to be 'root'. Hence, the privileged user (i.e. root) > will have all the privileges even when not all of them are required. > This is not the current recommended practice, but is this acceptable at > all? The server only needs to run as root if it needs to read files that are only accessible by root. What I don't get from the documentation is whether the user/password information is stored in the normal Solaris repositories (files/nis/ldap/etc) or whether there is a separate database containing the username/password pairs for "socks-access". If there is a separate database, there might not be a need to run as root at all. If the normal UNIX accounts are used for authentication there might be such a need. I'd be slightly surprised, though, to see an internet-facing machine with access to all username/password pairs used on the intranet. Joep From Joep.Vesseur@Sun.COM Tue Nov 18 00:36:41 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAI8afUW017309; Tue, 18 Nov 2008 00:36:41 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAI8aeBf012926; Tue, 18 Nov 2008 00:36:40 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAI0070HT94YO00@nwk-avmta-2.sfbay.sun.com>; Tue, 18 Nov 2008 00:36:40 -0800 (PST) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAI0064AT92NP20@nwk-avmta-2.sfbay.sun.com>; Tue, 18 Nov 2008 00:36:39 -0800 (PST) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe3.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAI8aaGM026846; Tue, 18 Nov 2008 08:36:38 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAI00K01T4QI300@fe-emea-09.sun.com> (original mail from Joep.Vesseur@Sun.COM); Tue, 18 Nov 2008 08:36:36 +0000 (GMT) Received: from [10.16.117.32] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAI008AMT8ING40@fe-emea-09.sun.com>; Tue, 18 Nov 2008 08:36:18 +0000 (GMT) Date: Tue, 18 Nov 2008 09:36:17 +0100 From: Joep Vesseur Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <4921C3AA.3000104@sun.com> Sender: Joep.Vesseur@Sun.COM To: James Gates Cc: psarc-ext@Sun.COM, Mayuresh Nirhali , lsarc-ext@Sun.COM Message-id: <49227E81.2080102@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <4921C3AA.3000104@sun.com> User-Agent: Thunderbird 2.0.0.17 (X11/20081014) Status: RO Content-Length: 1355 On 11/17/08 20:19, James Gates wrote: > [1] The way dante server is implemented, it does not confirm to the > recommended practice in Solaris of using the privilege mechanism. The > server implementation depends on the privileged and notprivileged users > configured, instead of adding and releasing privileges to the users. > Does the ARC approve of such implementation to be integrated into Solaris? > > [2] Dante server uses Solaris PAM for authentication which requires the > privileged user to be 'root'. Hence, the privileged user (i.e. root) > will have all the privileges even when not all of them are required. > This is not the current recommended practice, but is this acceptable at > all? The server only needs to run as root if it needs to read files that are only accessible by root. What I don't get from the documentation is whether the user/password information is stored in the normal Solaris repositories (files/nis/ldap/etc) or whether there is a separate database containing the username/password pairs for "socks-access". If there is a separate database, there might not be a need to run as root at all. If the normal UNIX accounts are used for authentication there might be such a need. I'd be slightly surprised, though, to see an internet-facing machine with access to all username/password pairs used on the intranet. Joep From Mayuresh.Nirhali@sun.com Tue Nov 18 00:57:03 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAI8v3hN017758; Tue, 18 Nov 2008 00:57:03 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAI8v2uw029756; Tue, 18 Nov 2008 01:57:03 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAI00809U72S500@nwk-avmta-2.sfbay.sun.com>; Tue, 18 Nov 2008 00:57:02 -0800 (PST) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAI006RVU71NQ30@nwk-avmta-2.sfbay.sun.com>; Tue, 18 Nov 2008 00:57:02 -0800 (PST) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAI8v0oQ000695; Tue, 18 Nov 2008 08:57:00 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAI00F01TZRNP00@mail-apac.sun.com> (original mail from Mayuresh.Nirhali@Sun.COM); Tue, 18 Nov 2008 16:57:00 +0800 (SGT) Received: from [129.158.227.167] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAI001BUU6KGRFW@mail-apac.sun.com>; Tue, 18 Nov 2008 16:56:50 +0800 (SGT) Date: Tue, 18 Nov 2008 14:26:40 +0530 From: Mayuresh Nirhali Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <49227E81.2080102@Sun.COM> Sender: Mayuresh.Nirhali@sun.com To: Joep Vesseur Cc: James Gates , psarc-ext@sun.com, lsarc-ext@sun.com Message-id: <49228348.40707@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> User-Agent: Thunderbird 2.0.0.16 (X11/20080908) Status: RO Content-Length: 2086 Joep, Thanks for your response, please see my comments inline... Joep Vesseur wrote: > On 11/17/08 20:19, James Gates wrote: > > >> [1] The way dante server is implemented, it does not confirm to the >> recommended practice in Solaris of using the privilege mechanism. The >> server implementation depends on the privileged and notprivileged users >> configured, instead of adding and releasing privileges to the users. >> Does the ARC approve of such implementation to be integrated into Solaris? >> >> [2] Dante server uses Solaris PAM for authentication which requires the >> privileged user to be 'root'. Hence, the privileged user (i.e. root) >> will have all the privileges even when not all of them are required. >> This is not the current recommended practice, but is this acceptable at >> all? >> > > The server only needs to run as root if it needs to read files that are > only accessible by root. What I don't get from the documentation is whether > the user/password information is stored in the normal Solaris repositories > (files/nis/ldap/etc) or whether there is a separate database containing > the username/password pairs for "socks-access". > Dante does not maintain a separate database for the username/password pairs. It relies on the native database (/etc/passwd/ldap). > If there is a separate database, there might not be a need to run as root at > all. > > If the normal UNIX accounts are used for authentication there might be such a > need. I'd be slightly surprised, though, to see an internet-facing machine > with access to all username/password pairs used on the intranet. > Yes, thats exactly why I ask. The implementation is such that it switches to effective euid of user.notprivileged as configured (per the proposed solution for the vanilla configuration as 'root') just before attempting a task that needs privileges and switches back to notprivileged uid immediately after the task/operation is over. I am not very sure how vulnerable the setup would be to attacks, if euid is root during the privileged operation?? Mayuresh From Mayuresh.Nirhali@sun.com Tue Nov 18 00:57:03 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAI8v3hN017758; Tue, 18 Nov 2008 00:57:03 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAI8v2uw029756; Tue, 18 Nov 2008 01:57:03 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAI00809U72S500@nwk-avmta-2.sfbay.sun.com>; Tue, 18 Nov 2008 00:57:02 -0800 (PST) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAI006RVU71NQ30@nwk-avmta-2.sfbay.sun.com>; Tue, 18 Nov 2008 00:57:02 -0800 (PST) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAI8v0oQ000695; Tue, 18 Nov 2008 08:57:00 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAI00F01TZRNP00@mail-apac.sun.com> (original mail from Mayuresh.Nirhali@Sun.COM); Tue, 18 Nov 2008 16:57:00 +0800 (SGT) Received: from [129.158.227.167] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAI001BUU6KGRFW@mail-apac.sun.com>; Tue, 18 Nov 2008 16:56:50 +0800 (SGT) Date: Tue, 18 Nov 2008 14:26:40 +0530 From: Mayuresh Nirhali Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <49227E81.2080102@Sun.COM> Sender: Mayuresh.Nirhali@sun.com To: Joep Vesseur Cc: James Gates , psarc-ext@sun.com, lsarc-ext@sun.com Message-id: <49228348.40707@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> User-Agent: Thunderbird 2.0.0.16 (X11/20080908) Status: RO Content-Length: 2086 Joep, Thanks for your response, please see my comments inline... Joep Vesseur wrote: > On 11/17/08 20:19, James Gates wrote: > > >> [1] The way dante server is implemented, it does not confirm to the >> recommended practice in Solaris of using the privilege mechanism. The >> server implementation depends on the privileged and notprivileged users >> configured, instead of adding and releasing privileges to the users. >> Does the ARC approve of such implementation to be integrated into Solaris? >> >> [2] Dante server uses Solaris PAM for authentication which requires the >> privileged user to be 'root'. Hence, the privileged user (i.e. root) >> will have all the privileges even when not all of them are required. >> This is not the current recommended practice, but is this acceptable at >> all? >> > > The server only needs to run as root if it needs to read files that are > only accessible by root. What I don't get from the documentation is whether > the user/password information is stored in the normal Solaris repositories > (files/nis/ldap/etc) or whether there is a separate database containing > the username/password pairs for "socks-access". > Dante does not maintain a separate database for the username/password pairs. It relies on the native database (/etc/passwd/ldap). > If there is a separate database, there might not be a need to run as root at > all. > > If the normal UNIX accounts are used for authentication there might be such a > need. I'd be slightly surprised, though, to see an internet-facing machine > with access to all username/password pairs used on the intranet. > Yes, thats exactly why I ask. The implementation is such that it switches to effective euid of user.notprivileged as configured (per the proposed solution for the vanilla configuration as 'root') just before attempting a task that needs privileges and switches back to notprivileged uid immediately after the task/operation is over. I am not very sure how vulnerable the setup would be to attacks, if euid is root during the privileged operation?? Mayuresh From Mayuresh.Nirhali@sun.com Tue Nov 18 01:03:16 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAI93Fvw018219; Tue, 18 Nov 2008 01:03:16 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id mAI92Lwe020582; Tue, 18 Nov 2008 17:03:14 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAI0081DUH9KF00@brm-avmta-1.central.sun.com>; Tue, 18 Nov 2008 02:03:09 -0700 (MST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAI00JBSUH7HG70@brm-avmta-1.central.sun.com>; Tue, 18 Nov 2008 02:03:08 -0700 (MST) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAI937GK017718; Tue, 18 Nov 2008 09:03:07 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAI00501UE3GV00@mail-apac.sun.com> (original mail from Mayuresh.Nirhali@Sun.COM); Tue, 18 Nov 2008 17:03:07 +0800 (SGT) Received: from [129.158.227.167] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAI00MFHUH6W506@mail-apac.sun.com>; Tue, 18 Nov 2008 17:03:07 +0800 (SGT) Date: Tue, 18 Nov 2008 14:33:02 +0530 From: Mayuresh Nirhali Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <49228348.40707@Sun.COM> Sender: Mayuresh.Nirhali@sun.com To: Joep Vesseur Cc: James Gates , psarc-ext@sun.com, lsarc-ext@sun.com Message-id: <492284C6.90404@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> User-Agent: Thunderbird 2.0.0.16 (X11/20080908) Status: RO Content-Length: 673 Oops... there is a typo in the para given below. The implementation is such that it switches to effective euid of *user.privileged* as configured .... Mayuresh Mayuresh Nirhali wrote: > Yes, thats exactly why I ask. > The implementation is such that it switches to effective euid of > *user.privileged* as configured (per the proposed solution for the > vanilla configuration as 'root') just before attempting a task that > needs privileges and switches back to notprivileged uid immediately > after the task/operation is over. I am not very sure how vulnerable > the setup would be to attacks, if euid is root during the privileged > operation?? > > Mayuresh > From Mayuresh.Nirhali@sun.com Tue Nov 18 01:03:16 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAI93Fvw018219; Tue, 18 Nov 2008 01:03:16 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id mAI92Lwe020582; Tue, 18 Nov 2008 17:03:14 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAI0081DUH9KF00@brm-avmta-1.central.sun.com>; Tue, 18 Nov 2008 02:03:09 -0700 (MST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAI00JBSUH7HG70@brm-avmta-1.central.sun.com>; Tue, 18 Nov 2008 02:03:08 -0700 (MST) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAI937GK017718; Tue, 18 Nov 2008 09:03:07 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAI00501UE3GV00@mail-apac.sun.com> (original mail from Mayuresh.Nirhali@Sun.COM); Tue, 18 Nov 2008 17:03:07 +0800 (SGT) Received: from [129.158.227.167] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAI00MFHUH6W506@mail-apac.sun.com>; Tue, 18 Nov 2008 17:03:07 +0800 (SGT) Date: Tue, 18 Nov 2008 14:33:02 +0530 From: Mayuresh Nirhali Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <49228348.40707@Sun.COM> Sender: Mayuresh.Nirhali@sun.com To: Joep Vesseur Cc: James Gates , psarc-ext@sun.com, lsarc-ext@sun.com Message-id: <492284C6.90404@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> User-Agent: Thunderbird 2.0.0.16 (X11/20080908) Status: RO Content-Length: 673 Oops... there is a typo in the para given below. The implementation is such that it switches to effective euid of *user.privileged* as configured .... Mayuresh Mayuresh Nirhali wrote: > Yes, thats exactly why I ask. > The implementation is such that it switches to effective euid of > *user.privileged* as configured (per the proposed solution for the > vanilla configuration as 'root') just before attempting a task that > needs privileges and switches back to notprivileged uid immediately > after the task/operation is over. I am not very sure how vulnerable > the setup would be to attacks, if euid is root during the privileged > operation?? > > Mayuresh > From Joep.Vesseur@sun.com Tue Nov 18 01:52:20 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAI9qKj4019424; Tue, 18 Nov 2008 01:52:20 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAI9qHND012226; Tue, 18 Nov 2008 02:52:20 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAI00A11WR6TS00@nwk-avmta-2.sfbay.sun.com>; Tue, 18 Nov 2008 01:52:18 -0800 (PST) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAI0067VWR5NR70@nwk-avmta-2.sfbay.sun.com>; Tue, 18 Nov 2008 01:52:18 -0800 (PST) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe3.eu.sun.com [192.18.6.12]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAI9qH5c011042; Tue, 18 Nov 2008 09:52:17 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAI00I01VN0P700@fe-emea-10.sun.com> (original mail from Joep.Vesseur@Sun.COM); Tue, 18 Nov 2008 09:52:17 +0000 (GMT) Received: from [10.16.117.32] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAI00IUKWPQ7260@fe-emea-10.sun.com>; Tue, 18 Nov 2008 09:51:32 +0000 (GMT) Date: Tue, 18 Nov 2008 10:51:26 +0100 From: Joep Vesseur Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <49228348.40707@Sun.COM> Sender: Joep.Vesseur@sun.com To: Mayuresh Nirhali Cc: James Gates , psarc-ext@sun.com, lsarc-ext@sun.com Message-id: <4922901E.8030009@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> User-Agent: Thunderbird 2.0.0.17 (X11/20081014) Status: RO Content-Length: 1931 On 11/18/08 09:56, Mayuresh Nirhali wrote: > Dante does not maintain a separate database for the username/password > pairs. > It relies on the native database (/etc/passwd/ldap). Surprising. I'm not sure if that's architecturally sound, but I guess this is just the way it is when we integrate 3rd party products. > Yes, thats exactly why I ask. > The implementation is such that it switches to effective euid of > user.privileged as configured (per the proposed solution for the > vanilla configuration as 'root') just before attempting a task that > needs privileges and switches back to notprivileged uid immediately > after the task/operation is over. I am not very sure how vulnerable the > setup would be to attacks, if euid is root during the privileged > operation?? That depends on the architecture of Dante, I think. A quick look at the code seems to indicate that it is single threaded, so it doesn't perform other operations while being switched to user.privileged; I guess the attack window from that perspective is low. A larger problem, however, is that the server constantly runs with it's saved uid set to user.privileged (root). Any successful attack on the code can just as easily do a seteuid(user.privileged) as the PAM code can. This sounds non-desirable. If this were a review of an in-house developed piece of software, I'd strongly suggest to find alternatives (either run with just the privileges needed to validate passwords, or run with a different database, or delegate authenticating users to a sub-task that doesn't deal with forwarding packets like the main daemon does). I don't know how far we'd go for imported products; I guess it depends on what we want to build on top of this. Note, however, that I'm not a PSARC member, just an interested lurker. As a Solaris PAM maintainer, I do think that the way Dante uses PAM is broken, suboptimal at best, but we can take that off-line. Joep From Joep.Vesseur@sun.com Tue Nov 18 01:52:20 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAI9qKj4019424; Tue, 18 Nov 2008 01:52:20 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAI9qHND012226; Tue, 18 Nov 2008 02:52:20 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAI00A11WR6TS00@nwk-avmta-2.sfbay.sun.com>; Tue, 18 Nov 2008 01:52:18 -0800 (PST) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAI0067VWR5NR70@nwk-avmta-2.sfbay.sun.com>; Tue, 18 Nov 2008 01:52:18 -0800 (PST) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe3.eu.sun.com [192.18.6.12]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAI9qH5c011042; Tue, 18 Nov 2008 09:52:17 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAI00I01VN0P700@fe-emea-10.sun.com> (original mail from Joep.Vesseur@Sun.COM); Tue, 18 Nov 2008 09:52:17 +0000 (GMT) Received: from [10.16.117.32] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAI00IUKWPQ7260@fe-emea-10.sun.com>; Tue, 18 Nov 2008 09:51:32 +0000 (GMT) Date: Tue, 18 Nov 2008 10:51:26 +0100 From: Joep Vesseur Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <49228348.40707@Sun.COM> Sender: Joep.Vesseur@sun.com To: Mayuresh Nirhali Cc: James Gates , psarc-ext@sun.com, lsarc-ext@sun.com Message-id: <4922901E.8030009@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> User-Agent: Thunderbird 2.0.0.17 (X11/20081014) Status: RO Content-Length: 1931 On 11/18/08 09:56, Mayuresh Nirhali wrote: > Dante does not maintain a separate database for the username/password > pairs. > It relies on the native database (/etc/passwd/ldap). Surprising. I'm not sure if that's architecturally sound, but I guess this is just the way it is when we integrate 3rd party products. > Yes, thats exactly why I ask. > The implementation is such that it switches to effective euid of > user.privileged as configured (per the proposed solution for the > vanilla configuration as 'root') just before attempting a task that > needs privileges and switches back to notprivileged uid immediately > after the task/operation is over. I am not very sure how vulnerable the > setup would be to attacks, if euid is root during the privileged > operation?? That depends on the architecture of Dante, I think. A quick look at the code seems to indicate that it is single threaded, so it doesn't perform other operations while being switched to user.privileged; I guess the attack window from that perspective is low. A larger problem, however, is that the server constantly runs with it's saved uid set to user.privileged (root). Any successful attack on the code can just as easily do a seteuid(user.privileged) as the PAM code can. This sounds non-desirable. If this were a review of an in-house developed piece of software, I'd strongly suggest to find alternatives (either run with just the privileges needed to validate passwords, or run with a different database, or delegate authenticating users to a sub-task that doesn't deal with forwarding packets like the main daemon does). I don't know how far we'd go for imported products; I guess it depends on what we want to build on top of this. Note, however, that I'm not a PSARC member, just an interested lurker. As a Solaris PAM maintainer, I do think that the way Dante uses PAM is broken, suboptimal at best, but we can take that off-line. Joep From carlsonj@phorcys.east.sun.com Tue Nov 18 05:33:49 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAIDXn7g024722; Tue, 18 Nov 2008 05:33:49 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAIDXfu6014226; Tue, 18 Nov 2008 05:33:43 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAJ00B0T705UM00@brm-avmta-1.central.sun.com>; Tue, 18 Nov 2008 06:33:41 -0700 (MST) Received: from phorcys.east.sun.com ([129.148.174.143]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAJ00GOS704SZD0@brm-avmta-1.central.sun.com>; Tue, 18 Nov 2008 06:33:41 -0700 (MST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mAIDXeGn013210; Tue, 18 Nov 2008 08:33:40 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mAIDXevn013207; Tue, 18 Nov 2008 08:33:40 -0500 (EST) Date: Tue, 18 Nov 2008 08:33:40 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <4922901E.8030009@Sun.COM> To: Joep Vesseur Cc: Mayuresh Nirhali , psarc-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <18722.50228.501128.841106@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> Status: RO Content-Length: 2415 Joep Vesseur writes: > If this were a review of an in-house developed piece of software, I'd strongly > suggest to find alternatives (either run with just the privileges needed to > validate passwords, or run with a different database, or delegate > authenticating users to a sub-task that doesn't deal with forwarding packets > like the main daemon does). I don't know how far we'd go for imported > products; I guess it depends on what we want to build on top of this. I think having a separate, generic authenticator daemon to run the PAM functions on behalf of less-privileged programs (and thus isolating the must-have-all-privileges-and-EUID-0 nature of PAM's access to /etc/shadow to a single process) would be a nice addition to the system. It sounds like a good project to me, but I don't think it's this one. (If it is done here, then it'd be the sort of privilege fork hack that you're describing, and I'd be less in favor of that unless it's well maintained upstream.) I agree that using PAM is a bit architecturally suspicious, as we're not authenticating users for the purpose of logging them into the system, but it has operational advantages, including: - The administrator can modify pam.conf to insert locally useful changes to the stack used with this daemon, and thus implement local policy. No changes to the daemon required; cheap and effective. - Using the same user database as the rest of the system simplifies administration. You don't need a separate set of tools to administer SOCKS users, and, more importantly, when you remove a user from the system, his SOCKS access goes away, too. Having multiple databases (as you're recommending) increases the chances of accidentally leaving an unwanted user ID hidden somewhere in some obscure application's database, because we don't have a global administration tool. What we *really* need for these network services is a well-supported AAA infrastructure. Too bad we don't have that. > Note, however, that I'm not a PSARC member, just an interested lurker. The point of the ARC is to get interested lurkers to comment on relevant cases, so you're welcome here. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From carlsonj@phorcys.east.sun.com Tue Nov 18 05:33:49 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAIDXn7g024722; Tue, 18 Nov 2008 05:33:49 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAIDXfu6014226; Tue, 18 Nov 2008 05:33:43 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAJ00B0T705UM00@brm-avmta-1.central.sun.com>; Tue, 18 Nov 2008 06:33:41 -0700 (MST) Received: from phorcys.east.sun.com ([129.148.174.143]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAJ00GOS704SZD0@brm-avmta-1.central.sun.com>; Tue, 18 Nov 2008 06:33:41 -0700 (MST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mAIDXeGn013210; Tue, 18 Nov 2008 08:33:40 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mAIDXevn013207; Tue, 18 Nov 2008 08:33:40 -0500 (EST) Date: Tue, 18 Nov 2008 08:33:40 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <4922901E.8030009@Sun.COM> To: Joep Vesseur Cc: Mayuresh Nirhali , psarc-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <18722.50228.501128.841106@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> Status: RO Content-Length: 2415 Joep Vesseur writes: > If this were a review of an in-house developed piece of software, I'd strongly > suggest to find alternatives (either run with just the privileges needed to > validate passwords, or run with a different database, or delegate > authenticating users to a sub-task that doesn't deal with forwarding packets > like the main daemon does). I don't know how far we'd go for imported > products; I guess it depends on what we want to build on top of this. I think having a separate, generic authenticator daemon to run the PAM functions on behalf of less-privileged programs (and thus isolating the must-have-all-privileges-and-EUID-0 nature of PAM's access to /etc/shadow to a single process) would be a nice addition to the system. It sounds like a good project to me, but I don't think it's this one. (If it is done here, then it'd be the sort of privilege fork hack that you're describing, and I'd be less in favor of that unless it's well maintained upstream.) I agree that using PAM is a bit architecturally suspicious, as we're not authenticating users for the purpose of logging them into the system, but it has operational advantages, including: - The administrator can modify pam.conf to insert locally useful changes to the stack used with this daemon, and thus implement local policy. No changes to the daemon required; cheap and effective. - Using the same user database as the rest of the system simplifies administration. You don't need a separate set of tools to administer SOCKS users, and, more importantly, when you remove a user from the system, his SOCKS access goes away, too. Having multiple databases (as you're recommending) increases the chances of accidentally leaving an unwanted user ID hidden somewhere in some obscure application's database, because we don't have a global administration tool. What we *really* need for these network services is a well-supported AAA infrastructure. Too bad we don't have that. > Note, however, that I'm not a PSARC member, just an interested lurker. The point of the ARC is to get interested lurkers to comment on relevant cases, so you're welcome here. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Jyri.Virkki@sun.com Tue Nov 18 21:24:45 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJ5Oi4C023895; Tue, 18 Nov 2008 21:24:44 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mAJ5OXLb008226; Wed, 19 Nov 2008 05:24:40 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAK00107F13RV00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 18 Nov 2008 21:24:39 -0800 (PST) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAK00JUCF12ENA0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 18 Nov 2008 21:24:39 -0800 (PST) Received: from dm-usca19-13.red.iplanet.com (host-179-56-18-192.iplanet.com [192.18.56.179] (may be forged)) by brmea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAJ5Ocvb016262; Wed, 19 Nov 2008 05:24:38 +0000 (GMT) Received: from buye.red.iplanet.com (buye [192.18.65.224]) by dm-usca19-13.red.iplanet.com (8.11.7p1+Sun/8.11.7/IPLANET,v1.2) with ESMTP id mAJ5Ocs10837; Tue, 18 Nov 2008 21:24:38 -0800 (PST) Received: from buye.red.iplanet.com (localhost [127.0.0.1]) by buye.red.iplanet.com (8.13.7+Sun/8.13.7) with ESMTP id mAJ5ObDD015041; Tue, 18 Nov 2008 21:24:37 -0800 (PST) Received: (from jyri@localhost) by buye.red.iplanet.com (8.13.7+Sun/8.13.7/Submit) id mAJ5ObHM015040; Tue, 18 Nov 2008 21:24:37 -0800 (PST) Date: Tue, 18 Nov 2008 21:24:37 -0800 From: Jyri Virkki Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <18722.50228.501128.841106@gargle.gargle.HOWL> To: James Carlson Cc: Joep Vesseur , Mayuresh Nirhali , psarc-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <20081119052437.GZ29832@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> User-Agent: Mutt/1.5.11 Status: RO Content-Length: 518 James Carlson wrote: > > I agree that using PAM is a bit architecturally suspicious, as we're > not authenticating users for the purpose of logging them into the > system, but it has operational advantages, including: For some historical trivia, PSARC/2002/053 for iPlanet Application Server 7 required the app server to add a module to support authentication via PAM. So that use case has been not only accepted but actually required by ARC in the past. -- Jyri J. Virkki - jyri.virkki@sun.com - Sun Microsystems From Jyri.Virkki@sun.com Tue Nov 18 21:24:45 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJ5Oi4C023895; Tue, 18 Nov 2008 21:24:44 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mAJ5OXLb008226; Wed, 19 Nov 2008 05:24:40 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAK00107F13RV00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 18 Nov 2008 21:24:39 -0800 (PST) Received: from brmea-mail-3.sun.com ([192.18.98.34]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAK00JUCF12ENA0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 18 Nov 2008 21:24:39 -0800 (PST) Received: from dm-usca19-13.red.iplanet.com (host-179-56-18-192.iplanet.com [192.18.56.179] (may be forged)) by brmea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAJ5Ocvb016262; Wed, 19 Nov 2008 05:24:38 +0000 (GMT) Received: from buye.red.iplanet.com (buye [192.18.65.224]) by dm-usca19-13.red.iplanet.com (8.11.7p1+Sun/8.11.7/IPLANET,v1.2) with ESMTP id mAJ5Ocs10837; Tue, 18 Nov 2008 21:24:38 -0800 (PST) Received: from buye.red.iplanet.com (localhost [127.0.0.1]) by buye.red.iplanet.com (8.13.7+Sun/8.13.7) with ESMTP id mAJ5ObDD015041; Tue, 18 Nov 2008 21:24:37 -0800 (PST) Received: (from jyri@localhost) by buye.red.iplanet.com (8.13.7+Sun/8.13.7/Submit) id mAJ5ObHM015040; Tue, 18 Nov 2008 21:24:37 -0800 (PST) Date: Tue, 18 Nov 2008 21:24:37 -0800 From: Jyri Virkki Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <18722.50228.501128.841106@gargle.gargle.HOWL> To: James Carlson Cc: Joep Vesseur , Mayuresh Nirhali , psarc-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <20081119052437.GZ29832@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> User-Agent: Mutt/1.5.11 Status: RO Content-Length: 518 James Carlson wrote: > > I agree that using PAM is a bit architecturally suspicious, as we're > not authenticating users for the purpose of logging them into the > system, but it has operational advantages, including: For some historical trivia, PSARC/2002/053 for iPlanet Application Server 7 required the app server to add a module to support authentication via PAM. So that use case has been not only accepted but actually required by ARC in the past. -- Jyri J. Virkki - jyri.virkki@sun.com - Sun Microsystems From Joep.Vesseur@sun.com Wed Nov 19 00:36:24 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJ8aOI2005083; Wed, 19 Nov 2008 00:36:24 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAJ8aNL4007499; Wed, 19 Nov 2008 00:36:24 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAK00D1JNWNHE00@brm-avmta-1.central.sun.com>; Wed, 19 Nov 2008 01:36:23 -0700 (MST) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAK002MXNWKI6B0@brm-avmta-1.central.sun.com>; Wed, 19 Nov 2008 01:36:21 -0700 (MST) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe3.eu.sun.com [192.18.6.10]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAJ8aKmw020828; Wed, 19 Nov 2008 08:36:20 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAK00L01NLU8N00@fe-emea-10.sun.com> (original mail from Joep.Vesseur@Sun.COM); Wed, 19 Nov 2008 08:36:20 +0000 (GMT) Received: from [10.16.117.32] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAK00CPCNWJ8YA0@fe-emea-10.sun.com>; Wed, 19 Nov 2008 08:36:20 +0000 (GMT) Date: Wed, 19 Nov 2008 09:36:19 +0100 From: Joep Vesseur Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <20081119052437.GZ29832@sun.com> Sender: Joep.Vesseur@sun.com Cc: psarc-ext@sun.com, lsarc-ext@sun.com Message-id: <4923D003.6060300@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119052437.GZ29832@sun.com> User-Agent: Thunderbird 2.0.0.17 (X11/20081014) Status: RO Content-Length: 1292 On 11/19/08 06:24, Jyri Virkki wrote: > James Carlson wrote: >> >> I agree that using PAM is a bit architecturally suspicious, as we're >> not authenticating users for the purpose of logging them into the >> system, but it has operational advantages, including: > > For some historical trivia, PSARC/2002/053 for iPlanet Application > Server 7 required the app server to add a module to support > authentication via PAM. So that use case has been not only accepted > but actually required by ARC in the past. Personally I wasn't worried that PAM was used to authenticate users; after all it is a perfect (well, perfect.. :) way to modularize access control policies. What I was surprised about is that PAM was being used to authenticate users against the normal system repositories, i.e. the ones containing actual system-login credentials. Personally, I'm not too fond of internet-facing systems processing all sorts of untrusted data having access to login-credentials. As Jim pointed out, there is a maintenance gain compared to setting up and maintaining separate databases, but from where I'm standing that doesn't compensate for the increased security risk. All of this is not relevant to the case at hand though, as the model has been decided on by the upstream developers. Joep From Joep.Vesseur@sun.com Wed Nov 19 00:36:24 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJ8aOI2005083; Wed, 19 Nov 2008 00:36:24 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAJ8aNL4007499; Wed, 19 Nov 2008 00:36:24 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAK00D1JNWNHE00@brm-avmta-1.central.sun.com>; Wed, 19 Nov 2008 01:36:23 -0700 (MST) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAK002MXNWKI6B0@brm-avmta-1.central.sun.com>; Wed, 19 Nov 2008 01:36:21 -0700 (MST) Received: from fe-emea-10.sun.com (gmp-eb-lb-1-fe3.eu.sun.com [192.18.6.10]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAJ8aKmw020828; Wed, 19 Nov 2008 08:36:20 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAK00L01NLU8N00@fe-emea-10.sun.com> (original mail from Joep.Vesseur@Sun.COM); Wed, 19 Nov 2008 08:36:20 +0000 (GMT) Received: from [10.16.117.32] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAK00CPCNWJ8YA0@fe-emea-10.sun.com>; Wed, 19 Nov 2008 08:36:20 +0000 (GMT) Date: Wed, 19 Nov 2008 09:36:19 +0100 From: Joep Vesseur Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <20081119052437.GZ29832@sun.com> Sender: Joep.Vesseur@sun.com Cc: psarc-ext@sun.com, lsarc-ext@sun.com Message-id: <4923D003.6060300@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119052437.GZ29832@sun.com> User-Agent: Thunderbird 2.0.0.17 (X11/20081014) Status: RO Content-Length: 1292 On 11/19/08 06:24, Jyri Virkki wrote: > James Carlson wrote: >> >> I agree that using PAM is a bit architecturally suspicious, as we're >> not authenticating users for the purpose of logging them into the >> system, but it has operational advantages, including: > > For some historical trivia, PSARC/2002/053 for iPlanet Application > Server 7 required the app server to add a module to support > authentication via PAM. So that use case has been not only accepted > but actually required by ARC in the past. Personally I wasn't worried that PAM was used to authenticate users; after all it is a perfect (well, perfect.. :) way to modularize access control policies. What I was surprised about is that PAM was being used to authenticate users against the normal system repositories, i.e. the ones containing actual system-login credentials. Personally, I'm not too fond of internet-facing systems processing all sorts of untrusted data having access to login-credentials. As Jim pointed out, there is a maintenance gain compared to setting up and maintaining separate databases, but from where I'm standing that doesn't compensate for the increased security risk. All of this is not relevant to the case at hand though, as the model has been decided on by the upstream developers. Joep From carlsonj@phorcys.east.sun.com Wed Nov 19 05:32:53 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJDWqbA014622; Wed, 19 Nov 2008 05:32:52 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAJDWkqX050750; Wed, 19 Nov 2008 06:32:46 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAL00M151MMNA00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 05:32:46 -0800 (PST) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAL008JZ1MKCZD0@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 05:32:45 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mAJDWiIu017837; Wed, 19 Nov 2008 08:32:44 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mAJDWiZY017834; Wed, 19 Nov 2008 08:32:44 -0500 (EST) Date: Wed, 19 Nov 2008 08:32:44 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <20081119052437.GZ29832@sun.com> To: Jyri Virkki Cc: Joep Vesseur , Mayuresh Nirhali , psarc-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <18724.5500.622201.133182@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119052437.GZ29832@sun.com> Status: RO Content-Length: 2140 Jyri Virkki writes: > James Carlson wrote: > > > > I agree that using PAM is a bit architecturally suspicious, as we're > > not authenticating users for the purpose of logging them into the > > system, but it has operational advantages, including: > > For some historical trivia, PSARC/2002/053 for iPlanet Application > Server 7 required the app server to add a module to support > authentication via PAM. So that use case has been not only accepted > but actually required by ARC in the past. Three points about that: The ARC is a body that has many members. It's the members who review things, so "required by ARC" is a bit of a wobbly concept. As with any other review, you'll get slightly different answers depending on the question asked and the people involved in the review. My reading of 2002/053 doesn't suggest at all that the ARC "required" PAM for that project. In fact, the record shows that we had the same discussion about PAM being used (optionally, as one of three realms) even though the user doesn't actually log into Solaris. (And going back to 1995/269, it's clear that the focus was system login, and not network application 'user' management.) Further reading suggests that the "Solaris realm" concept came from the project team, not from the ARC. I can find no record of a PAM discussion in the minutes. In any event, I think the original concern was about having excessive privileges for a network-facing program. (It may also have been about the third-party nature of the source, but I don't actually care about that issue.) The point I was raising was that we're lacking in architecture here. It should be possible to administer identities of users used for application purposes without necessarily tying those users to UNIX UIDs. It's the lack of administration that drives people to (ab)use PAM as something other than a system login mechanism. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From carlsonj@phorcys.east.sun.com Wed Nov 19 05:32:53 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJDWqbA014622; Wed, 19 Nov 2008 05:32:52 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAJDWkqX050750; Wed, 19 Nov 2008 06:32:46 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAL00M151MMNA00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 05:32:46 -0800 (PST) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAL008JZ1MKCZD0@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 05:32:45 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mAJDWiIu017837; Wed, 19 Nov 2008 08:32:44 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mAJDWiZY017834; Wed, 19 Nov 2008 08:32:44 -0500 (EST) Date: Wed, 19 Nov 2008 08:32:44 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <20081119052437.GZ29832@sun.com> To: Jyri Virkki Cc: Joep Vesseur , Mayuresh Nirhali , psarc-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <18724.5500.622201.133182@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119052437.GZ29832@sun.com> Status: RO Content-Length: 2140 Jyri Virkki writes: > James Carlson wrote: > > > > I agree that using PAM is a bit architecturally suspicious, as we're > > not authenticating users for the purpose of logging them into the > > system, but it has operational advantages, including: > > For some historical trivia, PSARC/2002/053 for iPlanet Application > Server 7 required the app server to add a module to support > authentication via PAM. So that use case has been not only accepted > but actually required by ARC in the past. Three points about that: The ARC is a body that has many members. It's the members who review things, so "required by ARC" is a bit of a wobbly concept. As with any other review, you'll get slightly different answers depending on the question asked and the people involved in the review. My reading of 2002/053 doesn't suggest at all that the ARC "required" PAM for that project. In fact, the record shows that we had the same discussion about PAM being used (optionally, as one of three realms) even though the user doesn't actually log into Solaris. (And going back to 1995/269, it's clear that the focus was system login, and not network application 'user' management.) Further reading suggests that the "Solaris realm" concept came from the project team, not from the ARC. I can find no record of a PAM discussion in the minutes. In any event, I think the original concern was about having excessive privileges for a network-facing program. (It may also have been about the third-party nature of the source, but I don't actually care about that issue.) The point I was raising was that we're lacking in architecture here. It should be possible to administer identities of users used for application purposes without necessarily tying those users to UNIX UIDs. It's the lack of administration that drives people to (ab)use PAM as something other than a system login mechanism. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From gdamore@sun.com Wed Nov 19 08:38:52 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJGcpgd021201; Wed, 19 Nov 2008 08:38:52 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id mAJGckWF022625; Thu, 20 Nov 2008 00:38:50 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAL00009A8P1P00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 08:38:49 -0800 (PST) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAL00L9JA8PCK10@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 08:38:49 -0800 (PST) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAJGcmKv001988; Wed, 19 Nov 2008 08:38:48 -0800 (PST) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAL003019DT0H00@fe-sfbay-10.sun.com> (original mail from gdamore@sun.com) ; Wed, 19 Nov 2008 08:38:48 -0800 (PST) Received: from [10.7.251.172] by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAL007RUA8BECH0@fe-sfbay-10.sun.com>; Wed, 19 Nov 2008 08:38:36 -0800 (PST) Date: Wed, 19 Nov 2008 08:32:42 -0800 From: "Garrett D'Amore" Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <4923D003.6060300@Sun.COM> Sender: Garrett.Damore@sun.com To: Joep Vesseur Cc: psarc-ext@sun.com, lsarc-ext@sun.com Message-id: <49243FAA.7020700@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119052437.GZ29832@sun.com> <4923D003.6060300@Sun.COM> User-Agent: Thunderbird 2.0.0.14 (X11/20080616) Status: RO Content-Length: 2499 Joep Vesseur wrote: > On 11/19/08 06:24, Jyri Virkki wrote: > >> James Carlson wrote: >> >>> I agree that using PAM is a bit architecturally suspicious, as we're >>> not authenticating users for the purpose of logging them into the >>> system, but it has operational advantages, including: >>> >> For some historical trivia, PSARC/2002/053 for iPlanet Application >> Server 7 required the app server to add a module to support >> authentication via PAM. So that use case has been not only accepted >> but actually required by ARC in the past. >> > > Personally I wasn't worried that PAM was used to authenticate users; after all > it is a perfect (well, perfect.. :) way to modularize access control > policies. What I was surprised about is that PAM was being used to > authenticate users against the normal system repositories, i.e. the ones > containing actual system-login credentials. Personally, I'm not too fond of > internet-facing systems processing all sorts of untrusted data having access > to login-credentials. > > As Jim pointed out, there is a maintenance gain compared to setting up and > maintaining separate databases, but from where I'm standing that doesn't > compensate for the increased security risk. > > All of this is not relevant to the case at hand though, as the model has been > decided on by the upstream developers. > > Joep > This problem (one of multiple credential databases, and separation of account namespaces, or at least credential details, into different databases) sounds like one of the areas where we (Sun/Solaris) can innovate. Right now there is a vacuum here, and so projects are faced with either inventing their own, or using the system credentials. The idea of using PAM infrastructure seems like a good one to me. But designing a full framework that allows for multiple authentication dbs is something that might not be trivial. Of course, all that is not this case. But if this case were a full case, a project to work on this seems like some advice we could give to the PAC. Perhaps we should derail so that we can offer this advice? (I'm on sabbatical, so I won't derail. But I propose that someone else do so, and we go right to a vote, since I don't think a full *review* is required for this case.) (Hmm... we've seen this before. Maybe ARC needs a better way to communicate advice to PAC. Perhaps a way to provide an "opinion" on a fast-track without actually derailing it?) -- Garrett From gdamore@sun.com Wed Nov 19 08:38:52 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJGcpgd021201; Wed, 19 Nov 2008 08:38:52 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id mAJGckWF022625; Thu, 20 Nov 2008 00:38:50 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAL00009A8P1P00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 08:38:49 -0800 (PST) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAL00L9JA8PCK10@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 08:38:49 -0800 (PST) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAJGcmKv001988; Wed, 19 Nov 2008 08:38:48 -0800 (PST) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAL003019DT0H00@fe-sfbay-10.sun.com> (original mail from gdamore@sun.com) ; Wed, 19 Nov 2008 08:38:48 -0800 (PST) Received: from [10.7.251.172] by fe-sfbay-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAL007RUA8BECH0@fe-sfbay-10.sun.com>; Wed, 19 Nov 2008 08:38:36 -0800 (PST) Date: Wed, 19 Nov 2008 08:32:42 -0800 From: "Garrett D'Amore" Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <4923D003.6060300@Sun.COM> Sender: Garrett.Damore@sun.com To: Joep Vesseur Cc: psarc-ext@sun.com, lsarc-ext@sun.com Message-id: <49243FAA.7020700@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119052437.GZ29832@sun.com> <4923D003.6060300@Sun.COM> User-Agent: Thunderbird 2.0.0.14 (X11/20080616) Status: RO Content-Length: 2499 Joep Vesseur wrote: > On 11/19/08 06:24, Jyri Virkki wrote: > >> James Carlson wrote: >> >>> I agree that using PAM is a bit architecturally suspicious, as we're >>> not authenticating users for the purpose of logging them into the >>> system, but it has operational advantages, including: >>> >> For some historical trivia, PSARC/2002/053 for iPlanet Application >> Server 7 required the app server to add a module to support >> authentication via PAM. So that use case has been not only accepted >> but actually required by ARC in the past. >> > > Personally I wasn't worried that PAM was used to authenticate users; after all > it is a perfect (well, perfect.. :) way to modularize access control > policies. What I was surprised about is that PAM was being used to > authenticate users against the normal system repositories, i.e. the ones > containing actual system-login credentials. Personally, I'm not too fond of > internet-facing systems processing all sorts of untrusted data having access > to login-credentials. > > As Jim pointed out, there is a maintenance gain compared to setting up and > maintaining separate databases, but from where I'm standing that doesn't > compensate for the increased security risk. > > All of this is not relevant to the case at hand though, as the model has been > decided on by the upstream developers. > > Joep > This problem (one of multiple credential databases, and separation of account namespaces, or at least credential details, into different databases) sounds like one of the areas where we (Sun/Solaris) can innovate. Right now there is a vacuum here, and so projects are faced with either inventing their own, or using the system credentials. The idea of using PAM infrastructure seems like a good one to me. But designing a full framework that allows for multiple authentication dbs is something that might not be trivial. Of course, all that is not this case. But if this case were a full case, a project to work on this seems like some advice we could give to the PAC. Perhaps we should derail so that we can offer this advice? (I'm on sabbatical, so I won't derail. But I propose that someone else do so, and we go right to a vote, since I don't think a full *review* is required for this case.) (Hmm... we've seen this before. Maybe ARC needs a better way to communicate advice to PAC. Perhaps a way to provide an "opinion" on a fast-track without actually derailing it?) -- Garrett From carlsonj@phorcys.east.sun.com Wed Nov 19 08:47:14 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJGlEF7021428; Wed, 19 Nov 2008 08:47:14 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAJGl631054961; Wed, 19 Nov 2008 09:47:12 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAL0010XAMN5R00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 08:47:11 -0800 (PST) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAL00L4HAMLCK20@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 08:47:10 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mAJGl9KM019154; Wed, 19 Nov 2008 11:47:09 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mAJGl948019151; Wed, 19 Nov 2008 11:47:09 -0500 (EST) Date: Wed, 19 Nov 2008 11:47:09 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <49243FAA.7020700@sun.com> To: "Garrett D'Amore" Cc: Joep Vesseur , psarc-ext@sun.com, lsarc-ext@sun.com Message-id: <18724.17165.749041.339238@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119052437.GZ29832@sun.com> <4923D003.6060300@Sun.COM> <49243FAA.7020700@sun.com> Status: RO Content-Length: 830 Garrett D'Amore writes: > (Hmm... we've seen this before. Maybe ARC needs a better way to > communicate advice to PAC. Perhaps a way to provide an "opinion" on a > fast-track without actually derailing it?) That process already exists; you just say something like this: "I'm derailing this fast-track for the purpose of issuing PAC advice. The advice will be to . Since that's the only reason I'm derailing, I'm also calling for a vote right now so that the project can proceed. All those to approve?" I don't think it's really worth it in this case, but if someone else does, have at it. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From carlsonj@phorcys.east.sun.com Wed Nov 19 08:47:14 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJGlEF7021428; Wed, 19 Nov 2008 08:47:14 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAJGl631054961; Wed, 19 Nov 2008 09:47:12 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAL0010XAMN5R00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 08:47:11 -0800 (PST) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAL00L4HAMLCK20@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 08:47:10 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mAJGl9KM019154; Wed, 19 Nov 2008 11:47:09 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mAJGl948019151; Wed, 19 Nov 2008 11:47:09 -0500 (EST) Date: Wed, 19 Nov 2008 11:47:09 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <49243FAA.7020700@sun.com> To: "Garrett D'Amore" Cc: Joep Vesseur , psarc-ext@sun.com, lsarc-ext@sun.com Message-id: <18724.17165.749041.339238@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119052437.GZ29832@sun.com> <4923D003.6060300@Sun.COM> <49243FAA.7020700@sun.com> Status: RO Content-Length: 830 Garrett D'Amore writes: > (Hmm... we've seen this before. Maybe ARC needs a better way to > communicate advice to PAC. Perhaps a way to provide an "opinion" on a > fast-track without actually derailing it?) That process already exists; you just say something like this: "I'm derailing this fast-track for the purpose of issuing PAC advice. The advice will be to . Since that's the only reason I'm derailing, I'm also calling for a vote right now so that the project can proceed. All those to approve?" I don't think it's really worth it in this case, but if someone else does, have at it. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Nicolas.Williams@sun.com Wed Nov 19 09:29:16 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJHTGQO024606; Wed, 19 Nov 2008 09:29:16 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAJHT8bK020065; Wed, 19 Nov 2008 09:29:10 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAL00003CKKIZ00@brm-avmta-1.central.sun.com>; Wed, 19 Nov 2008 10:29:08 -0700 (MST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAL00E5CCKH4PD0@brm-avmta-1.central.sun.com>; Wed, 19 Nov 2008 10:29:05 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id mAJHSMkm119607; Wed, 19 Nov 2008 11:28:22 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.14.3+Sun/8.14.3/Submit) id mAJHSLqv119606; Wed, 19 Nov 2008 11:28:21 -0600 (CST) Date: Wed, 19 Nov 2008 11:28:21 -0600 From: Nicolas Williams Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <18722.50228.501128.841106@gargle.gargle.HOWL> To: James Carlson Cc: Joep Vesseur , Mayuresh Nirhali , psarc-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <20081119172821.GP111792@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> X-Authentication-warning: binky.central.sun.com: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1096 On Tue, Nov 18, 2008 at 08:33:40AM -0500, James Carlson wrote: > Joep Vesseur writes: > > If this were a review of an in-house developed piece of software, I'd strongly > > suggest to find alternatives (either run with just the privileges needed to > > validate passwords, or run with a different database, or delegate > > authenticating users to a sub-task that doesn't deal with forwarding packets > > like the main daemon does). I don't know how far we'd go for imported > > products; I guess it depends on what we want to build on top of this. > > I think having a separate, generic authenticator daemon to run the PAM > functions on behalf of less-privileged programs (and thus isolating > [...] It's called embedded_su(1M) :) (Yes, it's not a daemon, it has to be fork/exec'ed, which means that the SOCKS daemon in this case must retain those basic privs, or build its own "authenticator daemon" which retains them and runs embedded_su on behalf of the main daemon which does not retain those basic privs. In any case, this is probably well outside the scope of the project.) Nico -- From Nicolas.Williams@sun.com Wed Nov 19 09:29:16 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJHTGQO024606; Wed, 19 Nov 2008 09:29:16 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAJHT8bK020065; Wed, 19 Nov 2008 09:29:10 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAL00003CKKIZ00@brm-avmta-1.central.sun.com>; Wed, 19 Nov 2008 10:29:08 -0700 (MST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAL00E5CCKH4PD0@brm-avmta-1.central.sun.com>; Wed, 19 Nov 2008 10:29:05 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id mAJHSMkm119607; Wed, 19 Nov 2008 11:28:22 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.14.3+Sun/8.14.3/Submit) id mAJHSLqv119606; Wed, 19 Nov 2008 11:28:21 -0600 (CST) Date: Wed, 19 Nov 2008 11:28:21 -0600 From: Nicolas Williams Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <18722.50228.501128.841106@gargle.gargle.HOWL> To: James Carlson Cc: Joep Vesseur , Mayuresh Nirhali , psarc-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <20081119172821.GP111792@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> X-Authentication-warning: binky.central.sun.com: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1096 On Tue, Nov 18, 2008 at 08:33:40AM -0500, James Carlson wrote: > Joep Vesseur writes: > > If this were a review of an in-house developed piece of software, I'd strongly > > suggest to find alternatives (either run with just the privileges needed to > > validate passwords, or run with a different database, or delegate > > authenticating users to a sub-task that doesn't deal with forwarding packets > > like the main daemon does). I don't know how far we'd go for imported > > products; I guess it depends on what we want to build on top of this. > > I think having a separate, generic authenticator daemon to run the PAM > functions on behalf of less-privileged programs (and thus isolating > [...] It's called embedded_su(1M) :) (Yes, it's not a daemon, it has to be fork/exec'ed, which means that the SOCKS daemon in this case must retain those basic privs, or build its own "authenticator daemon" which retains them and runs embedded_su on behalf of the main daemon which does not retain those basic privs. In any case, this is probably well outside the scope of the project.) Nico -- From Nicolas.Williams@Sun.COM Wed Nov 19 09:33:22 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJHXLlW022632; Wed, 19 Nov 2008 09:33:21 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mAJHX20T015978; Wed, 19 Nov 2008 17:33:18 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAL00701CRIH300@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 09:33:18 -0800 (PST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAL00LGWCRGCD70@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 09:33:17 -0800 (PST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id mAJHWaSe119614; Wed, 19 Nov 2008 11:32:36 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.14.3+Sun/8.14.3/Submit) id mAJHWaoV119613; Wed, 19 Nov 2008 11:32:36 -0600 (CST) Date: Wed, 19 Nov 2008 11:32:36 -0600 From: Nicolas Williams Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <49243FAA.7020700@sun.com> To: "Garrett D'Amore" Cc: Joep Vesseur , psarc-ext@Sun.COM, lsarc-ext@Sun.COM Message-id: <20081119173236.GQ111792@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119052437.GZ29832@sun.com> <4923D003.6060300@Sun.COM> <49243FAA.7020700@sun.com> X-Authentication-warning: binky.central.sun.com: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1035 On Wed, Nov 19, 2008 at 08:32:42AM -0800, Garrett D'Amore wrote: > This problem (one of multiple credential databases, and separation of > account namespaces, or at least credential details, into different > databases) sounds like one of the areas where we (Sun/Solaris) can > innovate. Right now there is a vacuum here, and so projects are faced > with either inventing their own, or using the system credentials. > > The idea of using PAM infrastructure seems like a good one to me. But > designing a full framework that allows for multiple authentication dbs > is something that might not be trivial. Use of PAM needs to be optional. There's no reason that the user base for any service or instance thereof needs to be the same as the Unix user base for the host running that service/instance. For Internet facing services which aren't edge services for internal users the need is usually to authenticate identities which bear little or no resemblance to the Unix user base on the hosts providing the service. Nico -- From Nicolas.Williams@Sun.COM Wed Nov 19 09:33:22 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJHXLlW022632; Wed, 19 Nov 2008 09:33:21 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mAJHX20T015978; Wed, 19 Nov 2008 17:33:18 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAL00701CRIH300@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 09:33:18 -0800 (PST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAL00LGWCRGCD70@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 09:33:17 -0800 (PST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id mAJHWaSe119614; Wed, 19 Nov 2008 11:32:36 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.14.3+Sun/8.14.3/Submit) id mAJHWaoV119613; Wed, 19 Nov 2008 11:32:36 -0600 (CST) Date: Wed, 19 Nov 2008 11:32:36 -0600 From: Nicolas Williams Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <49243FAA.7020700@sun.com> To: "Garrett D'Amore" Cc: Joep Vesseur , psarc-ext@Sun.COM, lsarc-ext@Sun.COM Message-id: <20081119173236.GQ111792@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119052437.GZ29832@sun.com> <4923D003.6060300@Sun.COM> <49243FAA.7020700@sun.com> X-Authentication-warning: binky.central.sun.com: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1035 On Wed, Nov 19, 2008 at 08:32:42AM -0800, Garrett D'Amore wrote: > This problem (one of multiple credential databases, and separation of > account namespaces, or at least credential details, into different > databases) sounds like one of the areas where we (Sun/Solaris) can > innovate. Right now there is a vacuum here, and so projects are faced > with either inventing their own, or using the system credentials. > > The idea of using PAM infrastructure seems like a good one to me. But > designing a full framework that allows for multiple authentication dbs > is something that might not be trivial. Use of PAM needs to be optional. There's no reason that the user base for any service or instance thereof needs to be the same as the Unix user base for the host running that service/instance. For Internet facing services which aren't edge services for internal users the need is usually to authenticate identities which bear little or no resemblance to the Unix user base on the hosts providing the service. Nico -- From carlsonj@phorcys.east.sun.com Wed Nov 19 09:40:09 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJHe9oQ010565; Wed, 19 Nov 2008 09:40:09 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAJHe0Ee019062; Wed, 19 Nov 2008 09:40:02 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAL00817D2Q8L00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 09:40:02 -0800 (PST) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAL00LJTD2PCM80@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 09:40:02 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mAJHe1kZ022124; Wed, 19 Nov 2008 12:40:01 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mAJHe1GT022121; Wed, 19 Nov 2008 12:40:01 -0500 (EST) Date: Wed, 19 Nov 2008 12:40:01 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <20081119172821.GP111792@Sun.COM> To: Nicolas Williams Cc: Mayuresh Nirhali , psarc-ext@sun.com, Joep Vesseur , lsarc-ext@sun.com, James Gates Message-id: <18724.20337.358531.758809@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> Status: RO Content-Length: 1071 Nicolas Williams writes: > It's called embedded_su(1M) :) I disagree. embedded_su was designed for applications that need to do the equivalent of 'su', but that need to do it from within some non-CLI environment. It's for the "click here and enter your admin password" GUI bits. In this case, we're not trying to *become* that UID at all. We don't care about the UID; it's irrelevant for the daemon. We care only about authenticating a user *name*. > (Yes, it's not a daemon, it has to be fork/exec'ed, which means that the > SOCKS daemon in this case must retain those basic privs, or build its > own "authenticator daemon" which retains them and runs embedded_su on > behalf of the main daemon which does not retain those basic privs. In > any case, this is probably well outside the scope of the project.) I agree with that last part. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From carlsonj@phorcys.east.sun.com Wed Nov 19 09:40:09 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJHe9oQ010565; Wed, 19 Nov 2008 09:40:09 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAJHe0Ee019062; Wed, 19 Nov 2008 09:40:02 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAL00817D2Q8L00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 09:40:02 -0800 (PST) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAL00LJTD2PCM80@nwk-avmta-1.sfbay.Sun.COM>; Wed, 19 Nov 2008 09:40:02 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mAJHe1kZ022124; Wed, 19 Nov 2008 12:40:01 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mAJHe1GT022121; Wed, 19 Nov 2008 12:40:01 -0500 (EST) Date: Wed, 19 Nov 2008 12:40:01 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <20081119172821.GP111792@Sun.COM> To: Nicolas Williams Cc: Mayuresh Nirhali , psarc-ext@sun.com, Joep Vesseur , lsarc-ext@sun.com, James Gates Message-id: <18724.20337.358531.758809@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> Status: RO Content-Length: 1071 Nicolas Williams writes: > It's called embedded_su(1M) :) I disagree. embedded_su was designed for applications that need to do the equivalent of 'su', but that need to do it from within some non-CLI environment. It's for the "click here and enter your admin password" GUI bits. In this case, we're not trying to *become* that UID at all. We don't care about the UID; it's irrelevant for the daemon. We care only about authenticating a user *name*. > (Yes, it's not a daemon, it has to be fork/exec'ed, which means that the > SOCKS daemon in this case must retain those basic privs, or build its > own "authenticator daemon" which retains them and runs embedded_su on > behalf of the main daemon which does not retain those basic privs. In > any case, this is probably well outside the scope of the project.) I agree with that last part. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Nicolas.Williams@sun.com Wed Nov 19 09:50:38 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJHocjT009338; Wed, 19 Nov 2008 09:50:38 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAJHoURu041285; Wed, 19 Nov 2008 10:50:32 -0700 (MST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAL0032XDK7CP00@brm-avmta-1.central.sun.com>; Wed, 19 Nov 2008 10:50:31 -0700 (MST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAL00EUPDK64WE0@brm-avmta-1.central.sun.com>; Wed, 19 Nov 2008 10:50:30 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id mAJHniLv119637; Wed, 19 Nov 2008 11:49:44 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.14.3+Sun/8.14.3/Submit) id mAJHnieT119636; Wed, 19 Nov 2008 11:49:44 -0600 (CST) Date: Wed, 19 Nov 2008 11:49:44 -0600 From: Nicolas Williams Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <18724.20337.358531.758809@gargle.gargle.HOWL> To: James Carlson Cc: Mayuresh Nirhali , psarc-ext@sun.com, Joep Vesseur , lsarc-ext@sun.com, James Gates Message-id: <20081119174943.GR111792@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> X-Authentication-warning: binky.central.sun.com: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1395 On Wed, Nov 19, 2008 at 12:40:01PM -0500, James Carlson wrote: > Nicolas Williams writes: > > It's called embedded_su(1M) :) > > I disagree. embedded_su was designed for applications that need to do > the equivalent of 'su', but that need to do it from within some > non-CLI environment. It's for the "click here and enter your admin > password" GUI bits. > > In this case, we're not trying to *become* that UID at all. We don't > care about the UID; it's irrelevant for the daemon. We care only > about authenticating a user *name*. embedded_su can do that just fine, just tell it to exec /bin/true (or false) :) But yes, I see the point, and I'll raise that embedded_su already has much of the code you need to build an "authenticator daemon." If you're trying to say "authenticate non-Unix users via PAM" that's another story. In the past I've pushed that angle too, but it's never caught on, and at least one ARC member, IIRC, strongly believes that PAM is solely for *Unix user* authentication and not intended for authenticating other types of users. OTOH, I'm pretty sure that people have used Apache with mod_auth_pam to implement authentication of non-Unix users, and have done so successfully -- libpam itself doesn't care about what {PAM_SERVICE, PAM_USER} refers to, it only knows how to run PAM_SERVICE and the rest is up to the configuration for that service. Nico -- From Nicolas.Williams@sun.com Wed Nov 19 09:50:38 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJHocjT009338; Wed, 19 Nov 2008 09:50:38 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAJHoURu041285; Wed, 19 Nov 2008 10:50:32 -0700 (MST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAL0032XDK7CP00@brm-avmta-1.central.sun.com>; Wed, 19 Nov 2008 10:50:31 -0700 (MST) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAL00EUPDK64WE0@brm-avmta-1.central.sun.com>; Wed, 19 Nov 2008 10:50:30 -0700 (MST) Received: from binky.central.sun.com (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id mAJHniLv119637; Wed, 19 Nov 2008 11:49:44 -0600 (CST) Received: (from nw141292@localhost) by binky.central.sun.com (8.14.3+Sun/8.14.3/Submit) id mAJHnieT119636; Wed, 19 Nov 2008 11:49:44 -0600 (CST) Date: Wed, 19 Nov 2008 11:49:44 -0600 From: Nicolas Williams Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <18724.20337.358531.758809@gargle.gargle.HOWL> To: James Carlson Cc: Mayuresh Nirhali , psarc-ext@sun.com, Joep Vesseur , lsarc-ext@sun.com, James Gates Message-id: <20081119174943.GR111792@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> X-Authentication-warning: binky.central.sun.com: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1395 On Wed, Nov 19, 2008 at 12:40:01PM -0500, James Carlson wrote: > Nicolas Williams writes: > > It's called embedded_su(1M) :) > > I disagree. embedded_su was designed for applications that need to do > the equivalent of 'su', but that need to do it from within some > non-CLI environment. It's for the "click here and enter your admin > password" GUI bits. > > In this case, we're not trying to *become* that UID at all. We don't > care about the UID; it's irrelevant for the daemon. We care only > about authenticating a user *name*. embedded_su can do that just fine, just tell it to exec /bin/true (or false) :) But yes, I see the point, and I'll raise that embedded_su already has much of the code you need to build an "authenticator daemon." If you're trying to say "authenticate non-Unix users via PAM" that's another story. In the past I've pushed that angle too, but it's never caught on, and at least one ARC member, IIRC, strongly believes that PAM is solely for *Unix user* authentication and not intended for authenticating other types of users. OTOH, I'm pretty sure that people have used Apache with mod_auth_pam to implement authentication of non-Unix users, and have done so successfully -- libpam itself doesn't care about what {PAM_SERVICE, PAM_USER} refers to, it only knows how to run PAM_SERVICE and the rest is up to the configuration for that service. Nico -- From Mayuresh.Nirhali@Sun.COM Mon Nov 24 02:43:14 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAOAhDBm005062; Mon, 24 Nov 2008 02:43:14 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id mAOAh1nm024339; Mon, 24 Nov 2008 18:43:12 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAU008053409100@brm-avmta-1.central.sun.com>; Mon, 24 Nov 2008 03:43:12 -0700 (MST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAU00LIG33YO570@brm-avmta-1.central.sun.com>; Mon, 24 Nov 2008 03:43:11 -0700 (MST) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAOAhAgD004562; Mon, 24 Nov 2008 10:43:10 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAU00I012Z40G00@mail-apac.sun.com> (original mail from Mayuresh.Nirhali@Sun.COM); Mon, 24 Nov 2008 18:43:10 +0800 (SGT) Received: from [129.158.227.167] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAU00MUT33XW51M@mail-apac.sun.com>; Mon, 24 Nov 2008 18:43:09 +0800 (SGT) Date: Mon, 24 Nov 2008 16:13:06 +0530 From: Mayuresh Nirhali Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <20081119174943.GR111792@Sun.COM> Sender: Mayuresh.Nirhali@Sun.COM To: psarc-ext@Sun.COM Cc: James Carlson , lsarc-ext@Sun.COM, James Gates Message-id: <492A853A.3050500@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> <20081119174943.GR111792@Sun.COM> User-Agent: Thunderbird 2.0.0.16 (X11/20080908) Status: RO Content-Length: 1638 Hello, Thanks to all who responded to this thread so far. So, Do we agree that dante cannot be integrated as is into Solaris ? TIA Mayuresh Nicolas Williams wrote: > On Wed, Nov 19, 2008 at 12:40:01PM -0500, James Carlson wrote: > >> Nicolas Williams writes: >> >>> It's called embedded_su(1M) :) >>> >> I disagree. embedded_su was designed for applications that need to do >> the equivalent of 'su', but that need to do it from within some >> non-CLI environment. It's for the "click here and enter your admin >> password" GUI bits. >> >> In this case, we're not trying to *become* that UID at all. We don't >> care about the UID; it's irrelevant for the daemon. We care only >> about authenticating a user *name*. >> > > embedded_su can do that just fine, just tell it to exec /bin/true (or > false) :) > > But yes, I see the point, and I'll raise that embedded_su already has > much of the code you need to build an "authenticator daemon." > > If you're trying to say "authenticate non-Unix users via PAM" that's > another story. In the past I've pushed that angle too, but it's never > caught on, and at least one ARC member, IIRC, strongly believes that PAM > is solely for *Unix user* authentication and not intended for > authenticating other types of users. > > OTOH, I'm pretty sure that people have used Apache with mod_auth_pam to > implement authentication of non-Unix users, and have done so > successfully -- libpam itself doesn't care about what {PAM_SERVICE, > PAM_USER} refers to, it only knows how to run PAM_SERVICE and the rest > is up to the configuration for that service. > > Nico > From Mayuresh.Nirhali@Sun.COM Mon Nov 24 02:43:14 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAOAhDBm005062; Mon, 24 Nov 2008 02:43:14 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id mAOAh1nm024339; Mon, 24 Nov 2008 18:43:12 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAU008053409100@brm-avmta-1.central.sun.com>; Mon, 24 Nov 2008 03:43:12 -0700 (MST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAU00LIG33YO570@brm-avmta-1.central.sun.com>; Mon, 24 Nov 2008 03:43:11 -0700 (MST) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAOAhAgD004562; Mon, 24 Nov 2008 10:43:10 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAU00I012Z40G00@mail-apac.sun.com> (original mail from Mayuresh.Nirhali@Sun.COM); Mon, 24 Nov 2008 18:43:10 +0800 (SGT) Received: from [129.158.227.167] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAU00MUT33XW51M@mail-apac.sun.com>; Mon, 24 Nov 2008 18:43:09 +0800 (SGT) Date: Mon, 24 Nov 2008 16:13:06 +0530 From: Mayuresh Nirhali Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <20081119174943.GR111792@Sun.COM> Sender: Mayuresh.Nirhali@Sun.COM To: psarc-ext@Sun.COM Cc: James Carlson , lsarc-ext@Sun.COM, James Gates Message-id: <492A853A.3050500@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> <20081119174943.GR111792@Sun.COM> User-Agent: Thunderbird 2.0.0.16 (X11/20080908) Status: RO Content-Length: 1638 Hello, Thanks to all who responded to this thread so far. So, Do we agree that dante cannot be integrated as is into Solaris ? TIA Mayuresh Nicolas Williams wrote: > On Wed, Nov 19, 2008 at 12:40:01PM -0500, James Carlson wrote: > >> Nicolas Williams writes: >> >>> It's called embedded_su(1M) :) >>> >> I disagree. embedded_su was designed for applications that need to do >> the equivalent of 'su', but that need to do it from within some >> non-CLI environment. It's for the "click here and enter your admin >> password" GUI bits. >> >> In this case, we're not trying to *become* that UID at all. We don't >> care about the UID; it's irrelevant for the daemon. We care only >> about authenticating a user *name*. >> > > embedded_su can do that just fine, just tell it to exec /bin/true (or > false) :) > > But yes, I see the point, and I'll raise that embedded_su already has > much of the code you need to build an "authenticator daemon." > > If you're trying to say "authenticate non-Unix users via PAM" that's > another story. In the past I've pushed that angle too, but it's never > caught on, and at least one ARC member, IIRC, strongly believes that PAM > is solely for *Unix user* authentication and not intended for > authenticating other types of users. > > OTOH, I'm pretty sure that people have used Apache with mod_auth_pam to > implement authentication of non-Unix users, and have done so > successfully -- libpam itself doesn't care about what {PAM_SERVICE, > PAM_USER} refers to, it only knows how to run PAM_SERVICE and the rest > is up to the configuration for that service. > > Nico > From carlsonj@phorcys.east.sun.com Mon Nov 24 03:39:17 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAOBdHGQ006590; Mon, 24 Nov 2008 03:39:17 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAOBd9R9048645; Mon, 24 Nov 2008 04:39:12 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAU00E0Z5PAVH00@nwk-avmta-2.sfbay.sun.com>; Mon, 24 Nov 2008 03:39:10 -0800 (PST) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAU007CV5P8QQA0@nwk-avmta-2.sfbay.sun.com>; Mon, 24 Nov 2008 03:39:08 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mAOBd7Jw014597; Mon, 24 Nov 2008 06:39:07 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mAOBd7Dn014594; Mon, 24 Nov 2008 06:39:07 -0500 (EST) Date: Mon, 24 Nov 2008 06:39:07 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <492A853A.3050500@Sun.COM> To: Mayuresh Nirhali Cc: psarc-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <18730.37467.902741.370102@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> <20081119174943.GR111792@Sun.COM> <492A853A.3050500@Sun.COM> Status: RO Content-Length: 1193 Mayuresh Nirhali writes: > Thanks to all who responded to this thread so far. > So, Do we agree that dante cannot be integrated as is into Solaris ? I can't speak for the others who responded, but I'm not in agreement with that. I think it should integrate, and that it should run as EUID==0 so that it can use PAM. If at all possible (and it certainly _should_ be possible), the daemon should be changed to give up as many privileges as it can. (If any of the members commenting believed that it couldn't be integrated at all or that it required changes that the project team was unwilling to agree to, then we have a process problem here. Fast-tracks can't be denied or have TCRs applied; that only happens with full cases, which means that a member needs to derail this in order to have a formal vote.) (Are you maybe jumping the gun? I suggest just reiterating exactly what you're intending to do in order to integrate, and asking if anyone wants to derail.) -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From carlsonj@phorcys.east.sun.com Mon Nov 24 03:39:17 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAOBdHGQ006590; Mon, 24 Nov 2008 03:39:17 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAOBd9R9048645; Mon, 24 Nov 2008 04:39:12 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAU00E0Z5PAVH00@nwk-avmta-2.sfbay.sun.com>; Mon, 24 Nov 2008 03:39:10 -0800 (PST) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAU007CV5P8QQA0@nwk-avmta-2.sfbay.sun.com>; Mon, 24 Nov 2008 03:39:08 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mAOBd7Jw014597; Mon, 24 Nov 2008 06:39:07 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mAOBd7Dn014594; Mon, 24 Nov 2008 06:39:07 -0500 (EST) Date: Mon, 24 Nov 2008 06:39:07 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <492A853A.3050500@Sun.COM> To: Mayuresh Nirhali Cc: psarc-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <18730.37467.902741.370102@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> <20081119174943.GR111792@Sun.COM> <492A853A.3050500@Sun.COM> Status: RO Content-Length: 1193 Mayuresh Nirhali writes: > Thanks to all who responded to this thread so far. > So, Do we agree that dante cannot be integrated as is into Solaris ? I can't speak for the others who responded, but I'm not in agreement with that. I think it should integrate, and that it should run as EUID==0 so that it can use PAM. If at all possible (and it certainly _should_ be possible), the daemon should be changed to give up as many privileges as it can. (If any of the members commenting believed that it couldn't be integrated at all or that it required changes that the project team was unwilling to agree to, then we have a process problem here. Fast-tracks can't be denied or have TCRs applied; that only happens with full cases, which means that a member needs to derail this in order to have a formal vote.) (Are you maybe jumping the gun? I suggest just reiterating exactly what you're intending to do in order to integrate, and asking if anyone wants to derail.) -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Mayuresh.Nirhali@Sun.COM Mon Nov 24 05:08:48 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAOD8lGf022414; Mon, 24 Nov 2008 05:08:47 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mAOD8jTN018067; Mon, 24 Nov 2008 13:08:46 GMT Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAU00L019UL0T00@nwk-avmta-2.sfbay.sun.com>; Mon, 24 Nov 2008 05:08:45 -0800 (PST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAU00IK69UKEIA0@nwk-avmta-2.sfbay.sun.com>; Mon, 24 Nov 2008 05:08:45 -0800 (PST) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAOD8hlj009674; Mon, 24 Nov 2008 13:08:43 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAU009019N7QH00@mail-apac.sun.com> (original mail from Mayuresh.Nirhali@Sun.COM); Mon, 24 Nov 2008 21:08:43 +0800 (SGT) Received: from [129.158.227.167] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAU001JR9UIGN55@mail-apac.sun.com>; Mon, 24 Nov 2008 21:08:43 +0800 (SGT) Date: Mon, 24 Nov 2008 18:38:40 +0530 From: Mayuresh Nirhali Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <18730.37467.902741.370102@gargle.gargle.HOWL> Sender: Mayuresh.Nirhali@Sun.COM To: James Carlson Cc: PSARC-ext@Sun.COM, lsarc-ext@Sun.COM, James Gates Message-id: <492AA758.608@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> <20081119174943.GR111792@Sun.COM> <492A853A.3050500@Sun.COM> <18730.37467.902741.370102@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.16 (X11/20080908) Status: RO Content-Length: 3143 James Carlson wrote: > Mayuresh Nirhali writes: > >> Thanks to all who responded to this thread so far. >> So, Do we agree that dante cannot be integrated as is into Solaris ? >> > > I can't speak for the others who responded, but I'm not in agreement > with that. I think it should integrate, and that it should run as > EUID==0 so that it can use PAM. If at all possible (and it certainly > _should_ be possible), the daemon should be changed to give up as many > privileges as it can. > I was seeking inputs from the ARC members to see if dante will be accepted in Solaris '_as is_'. i.e. without making major changes to this third party code. However, as discussed earlier, it did not seem like it is possible and just wanted to confirm the same. From what I understood in the discussion so far, dante, the way it is implemented today, should not be integrated for atleast to 2 reasons, 1. PAM requires UID=0, and in turn gains all the privileges (more than necessary for certain operations) 2. It does not seem to confirm to the Solaris PAM policy, as rightly pointed out by Joep. If we are considering changing the daemon then we will have to work with the community to have dante confirm to the Solaris policies or simply have the dante daemon resolve the security concerns by giving up as many privileges as it can, as you mentioned. But, the discussion also seem to indicate that there are certain aspects in Solaris that might need some work. I would appreciate more clarity/inputs on how we could proceed further with this ?? > (If any of the members commenting believed that it couldn't be > integrated at all or that it required changes that the project team > was unwilling to agree to, then we have a process problem here. > Fast-tracks can't be denied or have TCRs applied; that only happens > with full cases, which means that a member needs to derail this in > order to have a formal vote.) > I was not aware of that. Thanks for brining this up. I dont think I can commit at this moment that the changes we propose will be accepted by the community. Please note that, there is no evidence of any active development around this product currently, so interaction with the maintainers will atleast slow down the process if not block it. Hence, there is no guarantee that our changes to dante will be accepted. I only filed this as fasttrack, because the current version of the product seems to have good userbase and I was able to compile/run it fine on Solaris. little did I know about the security issues then ? > (Are you maybe jumping the gun? I suggest just reiterating exactly > what you're intending to do in order to integrate, and asking if > anyone wants to derail.) > > Not jumping the gun here. Just wanted to confirm if we all agree that the *current* implementation is not good enough for its integration to Solaris. Again, If there is an agreement that there is no way to get dante integrated without changing the source code, then, I will contact the maintainers to see if they can work with us to fix the security related issues. Best regards Mayuresh From Mayuresh.Nirhali@Sun.COM Mon Nov 24 05:08:48 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAOD8lGf022414; Mon, 24 Nov 2008 05:08:47 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mAOD8jTN018067; Mon, 24 Nov 2008 13:08:46 GMT Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAU00L019UL0T00@nwk-avmta-2.sfbay.sun.com>; Mon, 24 Nov 2008 05:08:45 -0800 (PST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAU00IK69UKEIA0@nwk-avmta-2.sfbay.sun.com>; Mon, 24 Nov 2008 05:08:45 -0800 (PST) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAOD8hlj009674; Mon, 24 Nov 2008 13:08:43 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAU009019N7QH00@mail-apac.sun.com> (original mail from Mayuresh.Nirhali@Sun.COM); Mon, 24 Nov 2008 21:08:43 +0800 (SGT) Received: from [129.158.227.167] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAU001JR9UIGN55@mail-apac.sun.com>; Mon, 24 Nov 2008 21:08:43 +0800 (SGT) Date: Mon, 24 Nov 2008 18:38:40 +0530 From: Mayuresh Nirhali Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <18730.37467.902741.370102@gargle.gargle.HOWL> Sender: Mayuresh.Nirhali@Sun.COM To: James Carlson Cc: PSARC-ext@Sun.COM, lsarc-ext@Sun.COM, James Gates Message-id: <492AA758.608@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> <20081119174943.GR111792@Sun.COM> <492A853A.3050500@Sun.COM> <18730.37467.902741.370102@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.16 (X11/20080908) Status: RO Content-Length: 3143 James Carlson wrote: > Mayuresh Nirhali writes: > >> Thanks to all who responded to this thread so far. >> So, Do we agree that dante cannot be integrated as is into Solaris ? >> > > I can't speak for the others who responded, but I'm not in agreement > with that. I think it should integrate, and that it should run as > EUID==0 so that it can use PAM. If at all possible (and it certainly > _should_ be possible), the daemon should be changed to give up as many > privileges as it can. > I was seeking inputs from the ARC members to see if dante will be accepted in Solaris '_as is_'. i.e. without making major changes to this third party code. However, as discussed earlier, it did not seem like it is possible and just wanted to confirm the same. From what I understood in the discussion so far, dante, the way it is implemented today, should not be integrated for atleast to 2 reasons, 1. PAM requires UID=0, and in turn gains all the privileges (more than necessary for certain operations) 2. It does not seem to confirm to the Solaris PAM policy, as rightly pointed out by Joep. If we are considering changing the daemon then we will have to work with the community to have dante confirm to the Solaris policies or simply have the dante daemon resolve the security concerns by giving up as many privileges as it can, as you mentioned. But, the discussion also seem to indicate that there are certain aspects in Solaris that might need some work. I would appreciate more clarity/inputs on how we could proceed further with this ?? > (If any of the members commenting believed that it couldn't be > integrated at all or that it required changes that the project team > was unwilling to agree to, then we have a process problem here. > Fast-tracks can't be denied or have TCRs applied; that only happens > with full cases, which means that a member needs to derail this in > order to have a formal vote.) > I was not aware of that. Thanks for brining this up. I dont think I can commit at this moment that the changes we propose will be accepted by the community. Please note that, there is no evidence of any active development around this product currently, so interaction with the maintainers will atleast slow down the process if not block it. Hence, there is no guarantee that our changes to dante will be accepted. I only filed this as fasttrack, because the current version of the product seems to have good userbase and I was able to compile/run it fine on Solaris. little did I know about the security issues then ? > (Are you maybe jumping the gun? I suggest just reiterating exactly > what you're intending to do in order to integrate, and asking if > anyone wants to derail.) > > Not jumping the gun here. Just wanted to confirm if we all agree that the *current* implementation is not good enough for its integration to Solaris. Again, If there is an agreement that there is no way to get dante integrated without changing the source code, then, I will contact the maintainers to see if they can work with us to fix the security related issues. Best regards Mayuresh From brian.utterback@sun.com Mon Nov 24 10:38:36 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAOIcZ8P016404; Mon, 24 Nov 2008 10:38:36 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAOIcYrv006134; Mon, 24 Nov 2008 11:38:35 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAU00H0HP4AR300@nwk-avmta-2.sfbay.sun.com>; Mon, 24 Nov 2008 10:38:34 -0800 (PST) Received: from dm-east-02.east.sun.com ([129.148.13.5]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAU00BU8P48O760@nwk-avmta-2.sfbay.sun.com>; Mon, 24 Nov 2008 10:38:33 -0800 (PST) Received: from [129.148.226.18] (sr1-unsh01-06.East.Sun.COM [129.148.226.18]) by dm-east-02.east.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mAOIcStG027226; Mon, 24 Nov 2008 13:38:29 -0500 (EST) Date: Mon, 24 Nov 2008 13:38:28 -0500 From: Brian Utterback Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <492AA758.608@Sun.COM> To: Mayuresh Nirhali Cc: James Carlson , PSARC-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <492AF4A4.4040407@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> <20081119174943.GR111792@Sun.COM> <492A853A.3050500@Sun.COM> <18730.37467.902741.370102@gargle.gargle.HOWL> <492AA758.608@Sun.COM> User-Agent: Thunderbird 2.0.0.19pre (X11/20081122) Status: RO Content-Length: 4036 If the changes are minor, perhaps the changes do not need to be pushed upstream. I know that in the SFW consolidation, there are many packages that apply a patch to the code before it is built. I wouldn't abandon the project without exploring the possibility. Mayuresh Nirhali wrote: > James Carlson wrote: >> Mayuresh Nirhali writes: >> >>> Thanks to all who responded to this thread so far. >>> So, Do we agree that dante cannot be integrated as is into Solaris ? >>> >> >> I can't speak for the others who responded, but I'm not in agreement >> with that. I think it should integrate, and that it should run as >> EUID==0 so that it can use PAM. If at all possible (and it certainly >> _should_ be possible), the daemon should be changed to give up as many >> privileges as it can. >> > I was seeking inputs from the ARC members to see if dante will be > accepted in Solaris '_as is_'. i.e. without making major changes to this > third party code. However, as discussed earlier, it did not seem like it > is possible and just wanted to confirm the same. > > From what I understood in the discussion so far, dante, the way it is > implemented today, should not be integrated for atleast to 2 reasons, > 1. PAM requires UID=0, and in turn gains all the privileges (more > than necessary for certain operations) > 2. It does not seem to confirm to the Solaris PAM policy, as rightly > pointed out by Joep. > > If we are considering changing the daemon then we will have to work with > the community to have dante confirm to the Solaris policies or simply > have the dante daemon resolve the security concerns by giving up as many > privileges as it can, as you mentioned. But, the discussion also seem to > indicate that there are certain aspects in Solaris that might need some > work. I would appreciate more clarity/inputs on how we could proceed > further with this ?? >> (If any of the members commenting believed that it couldn't be >> integrated at all or that it required changes that the project team >> was unwilling to agree to, then we have a process problem here. >> Fast-tracks can't be denied or have TCRs applied; that only happens >> with full cases, which means that a member needs to derail this in >> order to have a formal vote.) >> > I was not aware of that. Thanks for brining this up. > I dont think I can commit at this moment that the changes we propose > will be accepted by the community. Please note that, there is no > evidence of any active development around this product currently, so > interaction with the maintainers will atleast slow down the process if > not block it. Hence, there is no guarantee that our changes to dante > will be accepted. I only filed this as fasttrack, because the current > version of the product seems to have good userbase and I was able to > compile/run it fine on Solaris. little did I know about the security > issues then ? >> (Are you maybe jumping the gun? I suggest just reiterating exactly >> what you're intending to do in order to integrate, and asking if >> anyone wants to derail.) >> >> > Not jumping the gun here. Just wanted to confirm if we all agree that > the *current* implementation is not good enough for its integration to > Solaris. > > Again, If there is an agreement that there is no way to get dante > integrated without changing the source code, then, I will contact the > maintainers to see if they can work with us to fix the security related > issues. > > Best regards > Mayuresh > -- blu "Murderous organizations have increased in size and scope; they are more daring, they are served by the most terrible weapons offered by modern science, and the world is nowadays threatened by new forces which, if recklessly unchained, may some day wreck universal destruction." - Arthur Griffith, 1898 ---------------------------------------------------------------------- Brian Utterback - Solaris RPE, Sun Microsystems, Inc. Ph:877-259-7345, Em:brian.utterback-at-ess-you-enn-dot-kom From brian.utterback@sun.com Mon Nov 24 10:38:36 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAOIcZ8P016404; Mon, 24 Nov 2008 10:38:36 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAOIcYrv006134; Mon, 24 Nov 2008 11:38:35 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAU00H0HP4AR300@nwk-avmta-2.sfbay.sun.com>; Mon, 24 Nov 2008 10:38:34 -0800 (PST) Received: from dm-east-02.east.sun.com ([129.148.13.5]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAU00BU8P48O760@nwk-avmta-2.sfbay.sun.com>; Mon, 24 Nov 2008 10:38:33 -0800 (PST) Received: from [129.148.226.18] (sr1-unsh01-06.East.Sun.COM [129.148.226.18]) by dm-east-02.east.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mAOIcStG027226; Mon, 24 Nov 2008 13:38:29 -0500 (EST) Date: Mon, 24 Nov 2008 13:38:28 -0500 From: Brian Utterback Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <492AA758.608@Sun.COM> To: Mayuresh Nirhali Cc: James Carlson , PSARC-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <492AF4A4.4040407@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> <20081119174943.GR111792@Sun.COM> <492A853A.3050500@Sun.COM> <18730.37467.902741.370102@gargle.gargle.HOWL> <492AA758.608@Sun.COM> User-Agent: Thunderbird 2.0.0.19pre (X11/20081122) Status: RO Content-Length: 4036 If the changes are minor, perhaps the changes do not need to be pushed upstream. I know that in the SFW consolidation, there are many packages that apply a patch to the code before it is built. I wouldn't abandon the project without exploring the possibility. Mayuresh Nirhali wrote: > James Carlson wrote: >> Mayuresh Nirhali writes: >> >>> Thanks to all who responded to this thread so far. >>> So, Do we agree that dante cannot be integrated as is into Solaris ? >>> >> >> I can't speak for the others who responded, but I'm not in agreement >> with that. I think it should integrate, and that it should run as >> EUID==0 so that it can use PAM. If at all possible (and it certainly >> _should_ be possible), the daemon should be changed to give up as many >> privileges as it can. >> > I was seeking inputs from the ARC members to see if dante will be > accepted in Solaris '_as is_'. i.e. without making major changes to this > third party code. However, as discussed earlier, it did not seem like it > is possible and just wanted to confirm the same. > > From what I understood in the discussion so far, dante, the way it is > implemented today, should not be integrated for atleast to 2 reasons, > 1. PAM requires UID=0, and in turn gains all the privileges (more > than necessary for certain operations) > 2. It does not seem to confirm to the Solaris PAM policy, as rightly > pointed out by Joep. > > If we are considering changing the daemon then we will have to work with > the community to have dante confirm to the Solaris policies or simply > have the dante daemon resolve the security concerns by giving up as many > privileges as it can, as you mentioned. But, the discussion also seem to > indicate that there are certain aspects in Solaris that might need some > work. I would appreciate more clarity/inputs on how we could proceed > further with this ?? >> (If any of the members commenting believed that it couldn't be >> integrated at all or that it required changes that the project team >> was unwilling to agree to, then we have a process problem here. >> Fast-tracks can't be denied or have TCRs applied; that only happens >> with full cases, which means that a member needs to derail this in >> order to have a formal vote.) >> > I was not aware of that. Thanks for brining this up. > I dont think I can commit at this moment that the changes we propose > will be accepted by the community. Please note that, there is no > evidence of any active development around this product currently, so > interaction with the maintainers will atleast slow down the process if > not block it. Hence, there is no guarantee that our changes to dante > will be accepted. I only filed this as fasttrack, because the current > version of the product seems to have good userbase and I was able to > compile/run it fine on Solaris. little did I know about the security > issues then ? >> (Are you maybe jumping the gun? I suggest just reiterating exactly >> what you're intending to do in order to integrate, and asking if >> anyone wants to derail.) >> >> > Not jumping the gun here. Just wanted to confirm if we all agree that > the *current* implementation is not good enough for its integration to > Solaris. > > Again, If there is an agreement that there is no way to get dante > integrated without changing the source code, then, I will contact the > maintainers to see if they can work with us to fix the security related > issues. > > Best regards > Mayuresh > -- blu "Murderous organizations have increased in size and scope; they are more daring, they are served by the most terrible weapons offered by modern science, and the world is nowadays threatened by new forces which, if recklessly unchained, may some day wreck universal destruction." - Arthur Griffith, 1898 ---------------------------------------------------------------------- Brian Utterback - Solaris RPE, Sun Microsystems, Inc. Ph:877-259-7345, Em:brian.utterback-at-ess-you-enn-dot-kom From Jyri.Virkki@sun.com Mon Nov 24 11:36:00 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAOJa0dr018747; Mon, 24 Nov 2008 11:36:00 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAOJZq0O020892; Mon, 24 Nov 2008 11:35:54 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAU00H0FRRSNW00@brm-avmta-1.central.sun.com>; Mon, 24 Nov 2008 12:35:52 -0700 (MST) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAU00HHXRRS1710@brm-avmta-1.central.sun.com>; Mon, 24 Nov 2008 12:35:52 -0700 (MST) Received: from dm-usca15-11.red.iplanet.com (host-185-56-18-192.iplanet.com [192.18.56.185] (may be forged)) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAOJZpHd019390; Mon, 24 Nov 2008 19:35:51 +0000 (GMT) Received: from buye.red.iplanet.com (buye [192.18.65.224]) by dm-usca15-11.red.iplanet.com (8.11.7p1+Sun/8.11.7/IPLANET,v1.2) with ESMTP id mAOJZpm06992; Mon, 24 Nov 2008 11:35:51 -0800 (PST) Received: from buye.red.iplanet.com (localhost [127.0.0.1]) by buye.red.iplanet.com (8.13.7+Sun/8.13.7) with ESMTP id mAOJZpEj022493; Mon, 24 Nov 2008 11:35:51 -0800 (PST) Received: (from jyri@localhost) by buye.red.iplanet.com (8.13.7+Sun/8.13.7/Submit) id mAOJZp6O022492; Mon, 24 Nov 2008 11:35:51 -0800 (PST) Date: Mon, 24 Nov 2008 11:35:51 -0800 From: Jyri Virkki Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <18724.5500.622201.133182@gargle.gargle.HOWL> To: James Carlson Cc: Jyri Virkki , Joep Vesseur , Mayuresh Nirhali , psarc-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <20081124193551.GJ5565@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119052437.GZ29832@sun.com> <18724.5500.622201.133182@gargle.gargle.HOWL> User-Agent: Mutt/1.5.11 Status: RO Content-Length: 430 James Carlson wrote: > > The ARC is a body that has many members. It's the members who > review things, so "required by ARC" is a bit of a wobbly concept. Nothing wobbly about it, we have a distinction between what is the opinion of "the ARC" (the opinion) vs. what is chatter by individual members(+interns+observers) speaking for themselves (everything else). -- Jyri J. Virkki - jyri.virkki@sun.com - Sun Microsystems From Jyri.Virkki@sun.com Mon Nov 24 11:36:00 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAOJa0dr018747; Mon, 24 Nov 2008 11:36:00 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAOJZq0O020892; Mon, 24 Nov 2008 11:35:54 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAU00H0FRRSNW00@brm-avmta-1.central.sun.com>; Mon, 24 Nov 2008 12:35:52 -0700 (MST) Received: from brmea-mail-1.sun.com ([192.18.98.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAU00HHXRRS1710@brm-avmta-1.central.sun.com>; Mon, 24 Nov 2008 12:35:52 -0700 (MST) Received: from dm-usca15-11.red.iplanet.com (host-185-56-18-192.iplanet.com [192.18.56.185] (may be forged)) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAOJZpHd019390; Mon, 24 Nov 2008 19:35:51 +0000 (GMT) Received: from buye.red.iplanet.com (buye [192.18.65.224]) by dm-usca15-11.red.iplanet.com (8.11.7p1+Sun/8.11.7/IPLANET,v1.2) with ESMTP id mAOJZpm06992; Mon, 24 Nov 2008 11:35:51 -0800 (PST) Received: from buye.red.iplanet.com (localhost [127.0.0.1]) by buye.red.iplanet.com (8.13.7+Sun/8.13.7) with ESMTP id mAOJZpEj022493; Mon, 24 Nov 2008 11:35:51 -0800 (PST) Received: (from jyri@localhost) by buye.red.iplanet.com (8.13.7+Sun/8.13.7/Submit) id mAOJZp6O022492; Mon, 24 Nov 2008 11:35:51 -0800 (PST) Date: Mon, 24 Nov 2008 11:35:51 -0800 From: Jyri Virkki Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <18724.5500.622201.133182@gargle.gargle.HOWL> To: James Carlson Cc: Jyri Virkki , Joep Vesseur , Mayuresh Nirhali , psarc-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <20081124193551.GJ5565@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119052437.GZ29832@sun.com> <18724.5500.622201.133182@gargle.gargle.HOWL> User-Agent: Mutt/1.5.11 Status: RO Content-Length: 430 James Carlson wrote: > > The ARC is a body that has many members. It's the members who > review things, so "required by ARC" is a bit of a wobbly concept. Nothing wobbly about it, we have a distinction between what is the opinion of "the ARC" (the opinion) vs. what is chatter by individual members(+interns+observers) speaking for themselves (everything else). -- Jyri J. Virkki - jyri.virkki@sun.com - Sun Microsystems From Joep.Vesseur@sun.com Wed Nov 26 00:02:58 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAQ82wce002486; Wed, 26 Nov 2008 00:02:58 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAQ82uvs009248; Wed, 26 Nov 2008 00:02:58 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAX0030HL0VIV00@nwk-avmta-2.sfbay.sun.com>; Wed, 26 Nov 2008 00:02:55 -0800 (PST) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAX00EA6L0TZMB0@nwk-avmta-2.sfbay.sun.com>; Wed, 26 Nov 2008 00:02:54 -0800 (PST) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe3.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAQ82raS014666; Wed, 26 Nov 2008 08:02:53 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAX00201KJK4J00@fe-emea-09.sun.com> (original mail from Joep.Vesseur@Sun.COM); Wed, 26 Nov 2008 08:02:53 +0000 (GMT) Received: from [10.16.117.32] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAX0093PL0IYH80@fe-emea-09.sun.com>; Wed, 26 Nov 2008 08:02:42 +0000 (GMT) Date: Wed, 26 Nov 2008 09:02:41 +0100 From: Joep Vesseur Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <492AA758.608@Sun.COM> Sender: Joep.Vesseur@sun.com To: Mayuresh Nirhali Cc: PSARC-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <492D02A1.3040503@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> <20081119174943.GR111792@Sun.COM> <492A853A.3050500@Sun.COM> <18730.37467.902741.370102@gargle.gargle.HOWL> <492AA758.608@Sun.COM> User-Agent: Thunderbird 2.0.0.17 (X11/20081104) Status: RO Content-Length: 671 On 11/24/08 14:08, Mayuresh Nirhali wrote: > From what I understood in the discussion so far, dante, the way it is > implemented today, should not be integrated for atleast to 2 reasons, > 1. PAM requires UID=0, and in turn gains all the privileges (more > than necessary for certain operations) > 2. It does not seem to confirm to the Solaris PAM policy, as rightly > pointed out by Joep. I think 1) is "Just The Way It Is". It won't win a beauty contest, but it won't keep you from integrating either. I'm happy to work with you to resolve 2) in a patch to the upstream bits that can be integrated in the SFW consolidation. Joep -- just adding some "chatter" From Joep.Vesseur@sun.com Wed Nov 26 00:02:58 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAQ82wce002486; Wed, 26 Nov 2008 00:02:58 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAQ82uvs009248; Wed, 26 Nov 2008 00:02:58 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAX0030HL0VIV00@nwk-avmta-2.sfbay.sun.com>; Wed, 26 Nov 2008 00:02:55 -0800 (PST) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAX00EA6L0TZMB0@nwk-avmta-2.sfbay.sun.com>; Wed, 26 Nov 2008 00:02:54 -0800 (PST) Received: from fe-emea-09.sun.com (gmp-eb-lb-1-fe3.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id mAQ82raS014666; Wed, 26 Nov 2008 08:02:53 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAX00201KJK4J00@fe-emea-09.sun.com> (original mail from Joep.Vesseur@Sun.COM); Wed, 26 Nov 2008 08:02:53 +0000 (GMT) Received: from [10.16.117.32] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAX0093PL0IYH80@fe-emea-09.sun.com>; Wed, 26 Nov 2008 08:02:42 +0000 (GMT) Date: Wed, 26 Nov 2008 09:02:41 +0100 From: Joep Vesseur Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <492AA758.608@Sun.COM> Sender: Joep.Vesseur@sun.com To: Mayuresh Nirhali Cc: PSARC-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <492D02A1.3040503@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Enigmail-Version: 0.95.1 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> <20081119174943.GR111792@Sun.COM> <492A853A.3050500@Sun.COM> <18730.37467.902741.370102@gargle.gargle.HOWL> <492AA758.608@Sun.COM> User-Agent: Thunderbird 2.0.0.17 (X11/20081104) Status: RO Content-Length: 671 On 11/24/08 14:08, Mayuresh Nirhali wrote: > From what I understood in the discussion so far, dante, the way it is > implemented today, should not be integrated for atleast to 2 reasons, > 1. PAM requires UID=0, and in turn gains all the privileges (more > than necessary for certain operations) > 2. It does not seem to confirm to the Solaris PAM policy, as rightly > pointed out by Joep. I think 1) is "Just The Way It Is". It won't win a beauty contest, but it won't keep you from integrating either. I'm happy to work with you to resolve 2) in a patch to the upstream bits that can be integrated in the SFW consolidation. Joep -- just adding some "chatter" From carlsonj@phorcys.east.sun.com Wed Nov 26 05:07:43 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAQD7hqd015773; Wed, 26 Nov 2008 05:07:43 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAQD7cYf004669; Wed, 26 Nov 2008 05:07:38 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAX00M03Z4NVL00@brm-avmta-1.central.sun.com>; Wed, 26 Nov 2008 06:07:35 -0700 (MST) Received: from phorcys.east.sun.com ([129.148.174.143]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAX0012BZ4MKLE0@brm-avmta-1.central.sun.com>; Wed, 26 Nov 2008 06:07:35 -0700 (MST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mAQD7YdX024572; Wed, 26 Nov 2008 08:07:34 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mAQD7Ym8024569; Wed, 26 Nov 2008 08:07:34 -0500 (EST) Date: Wed, 26 Nov 2008 08:07:34 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <492D02A1.3040503@Sun.COM> To: Joep Vesseur Cc: Mayuresh Nirhali , PSARC-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <18733.18966.661874.510332@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> <20081119174943.GR111792@Sun.COM> <492A853A.3050500@Sun.COM> <18730.37467.902741.370102@gargle.gargle.HOWL> <492AA758.608@Sun.COM> <492D02A1.3040503@Sun.COM> Status: RO Content-Length: 442 Joep Vesseur writes: > I'm happy to work with you to resolve 2) in a patch to the upstream bits > that can be integrated in the SFW consolidation. "Will work with Joep to fix PAM bits" is certainly sufficient for me. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From carlsonj@phorcys.east.sun.com Wed Nov 26 05:07:43 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAQD7hqd015773; Wed, 26 Nov 2008 05:07:43 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAQD7cYf004669; Wed, 26 Nov 2008 05:07:38 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAX00M03Z4NVL00@brm-avmta-1.central.sun.com>; Wed, 26 Nov 2008 06:07:35 -0700 (MST) Received: from phorcys.east.sun.com ([129.148.174.143]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAX0012BZ4MKLE0@brm-avmta-1.central.sun.com>; Wed, 26 Nov 2008 06:07:35 -0700 (MST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mAQD7YdX024572; Wed, 26 Nov 2008 08:07:34 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mAQD7Ym8024569; Wed, 26 Nov 2008 08:07:34 -0500 (EST) Date: Wed, 26 Nov 2008 08:07:34 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <492D02A1.3040503@Sun.COM> To: Joep Vesseur Cc: Mayuresh Nirhali , PSARC-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <18733.18966.661874.510332@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> <20081119174943.GR111792@Sun.COM> <492A853A.3050500@Sun.COM> <18730.37467.902741.370102@gargle.gargle.HOWL> <492AA758.608@Sun.COM> <492D02A1.3040503@Sun.COM> Status: RO Content-Length: 442 Joep Vesseur writes: > I'm happy to work with you to resolve 2) in a patch to the upstream bits > that can be integrated in the SFW consolidation. "Will work with Joep to fix PAM bits" is certainly sufficient for me. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Mayuresh.Nirhali@sun.com Thu Nov 27 06:29:51 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mARETpBO000518; Thu, 27 Nov 2008 06:29:51 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mARETn8U026050; Thu, 27 Nov 2008 06:29:51 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAZ00M0DXLQ2B00@brm-avmta-1.central.sun.com>; Thu, 27 Nov 2008 07:29:50 -0700 (MST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAZ00854XLPEN90@brm-avmta-1.central.sun.com>; Thu, 27 Nov 2008 07:29:50 -0700 (MST) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mARETm18007673; Thu, 27 Nov 2008 14:29:48 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAZ00E01XCZKP00@mail-apac.sun.com> (original mail from Mayuresh.Nirhali@Sun.COM); Thu, 27 Nov 2008 22:29:48 +0800 (SGT) Received: from [129.158.227.167] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAZ001Q4XLNGR3T@mail-apac.sun.com>; Thu, 27 Nov 2008 22:29:48 +0800 (SGT) Date: Thu, 27 Nov 2008 19:59:46 +0530 From: Mayuresh Nirhali Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <492D02A1.3040503@Sun.COM> Sender: Mayuresh.Nirhali@sun.com To: Joep Vesseur Cc: PSARC-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <492EAEDA.10203@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> <20081119174943.GR111792@Sun.COM> <492A853A.3050500@Sun.COM> <18730.37467.902741.370102@gargle.gargle.HOWL> <492AA758.608@Sun.COM> <492D02A1.3040503@Sun.COM> User-Agent: Thunderbird 2.0.0.16 (X11/20080908) Status: RO Content-Length: 1355 I think, the changes required to confirm to the Solaris PAM policy should not be major. I will work with Joep to resolve them and come up with a patch that can be applied at build time in the SFW consolidation. ... Joep Vesseur wrote: > On 11/24/08 14:08, Mayuresh Nirhali wrote: >> rom what I understood in the discussion so far, dante, the way it is >> implemented today, should not be integrated for atleast to 2 reasons, >> 1. PAM requires UID=0, and in turn gains all the privileges (more >> than necessary for certain operations) >> 2. It does not seem to confirm to the Solaris PAM policy, as rightly >> pointed out by Joep. >> > > I think 1) is "Just The Way It Is". It won't win a beauty contest, but it > won't keep you from integrating either. > I am happy if ARC thinks 1) is NOT a blocker. Please let me know if anyone does not agree with Joep here ? I have sent a mail to dante maintainers informing them about the solaris porting issues. Also, I have found some odd behaviors with dante server implementation. While we wait for some response from the dante maintainers, I will try to get them resolved as well. Thanks for your support Mayuresh > I'm happy to work with you to resolve 2) in a patch to the upstream bits > that can be integrated in the SFW consolidation. > > Joep -- just adding some "chatter" > From Mayuresh.Nirhali@sun.com Thu Nov 27 06:29:51 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mARETpBO000518; Thu, 27 Nov 2008 06:29:51 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mARETn8U026050; Thu, 27 Nov 2008 06:29:51 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAZ00M0DXLQ2B00@brm-avmta-1.central.sun.com>; Thu, 27 Nov 2008 07:29:50 -0700 (MST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAZ00854XLPEN90@brm-avmta-1.central.sun.com>; Thu, 27 Nov 2008 07:29:50 -0700 (MST) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mARETm18007673; Thu, 27 Nov 2008 14:29:48 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAZ00E01XCZKP00@mail-apac.sun.com> (original mail from Mayuresh.Nirhali@Sun.COM); Thu, 27 Nov 2008 22:29:48 +0800 (SGT) Received: from [129.158.227.167] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAZ001Q4XLNGR3T@mail-apac.sun.com>; Thu, 27 Nov 2008 22:29:48 +0800 (SGT) Date: Thu, 27 Nov 2008 19:59:46 +0530 From: Mayuresh Nirhali Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <492D02A1.3040503@Sun.COM> Sender: Mayuresh.Nirhali@sun.com To: Joep Vesseur Cc: PSARC-ext@sun.com, lsarc-ext@sun.com, James Gates Message-id: <492EAEDA.10203@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <4921C3AA.3000104@sun.com> <49227E81.2080102@Sun.COM> <49228348.40707@Sun.COM> <4922901E.8030009@Sun.COM> <18722.50228.501128.841106@gargle.gargle.HOWL> <20081119172821.GP111792@Sun.COM> <18724.20337.358531.758809@gargle.gargle.HOWL> <20081119174943.GR111792@Sun.COM> <492A853A.3050500@Sun.COM> <18730.37467.902741.370102@gargle.gargle.HOWL> <492AA758.608@Sun.COM> <492D02A1.3040503@Sun.COM> User-Agent: Thunderbird 2.0.0.16 (X11/20080908) Status: RO Content-Length: 1355 I think, the changes required to confirm to the Solaris PAM policy should not be major. I will work with Joep to resolve them and come up with a patch that can be applied at build time in the SFW consolidation. ... Joep Vesseur wrote: > On 11/24/08 14:08, Mayuresh Nirhali wrote: >> rom what I understood in the discussion so far, dante, the way it is >> implemented today, should not be integrated for atleast to 2 reasons, >> 1. PAM requires UID=0, and in turn gains all the privileges (more >> than necessary for certain operations) >> 2. It does not seem to confirm to the Solaris PAM policy, as rightly >> pointed out by Joep. >> > > I think 1) is "Just The Way It Is". It won't win a beauty contest, but it > won't keep you from integrating either. > I am happy if ARC thinks 1) is NOT a blocker. Please let me know if anyone does not agree with Joep here ? I have sent a mail to dante maintainers informing them about the solaris porting issues. Also, I have found some odd behaviors with dante server implementation. While we wait for some response from the dante maintainers, I will try to get them resolved as well. Thanks for your support Mayuresh > I'm happy to work with you to resolve 2) in a patch to the upstream bits > that can be integrated in the SFW consolidation. > > Joep -- just adding some "chatter" > From gww@eng.sun.com Fri Nov 28 12:44:58 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mASKivHQ028507; Fri, 28 Nov 2008 12:44:58 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mASKilG5018466; Fri, 28 Nov 2008 20:44:56 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KB2007019MU4M00@nwk-avmta-1.sfbay.Sun.COM>; Fri, 28 Nov 2008 12:44:54 -0800 (PST) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KB2000C49MTNW20@nwk-avmta-1.sfbay.Sun.COM>; Fri, 28 Nov 2008 12:44:53 -0800 (PST) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mASKiosx034020; Fri, 28 Nov 2008 12:44:50 -0800 (PST) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id mASKiQOv005357; Fri, 28 Nov 2008 12:44:26 -0800 (PST) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id mASKiQal005356; Fri, 28 Nov 2008 12:44:26 -0800 (PST) Date: Fri, 28 Nov 2008 12:44:26 -0800 (PST) From: Gary Winiger Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] To: James.Gates@sun.com, psarc-ext@sun.com Cc: Mayuresh.Nirhali@sun.com, lsarc-ext@sun.com Message-id: <200811282044.mASKiQal005356@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 2954 I'm just getting back to this from the out of band LSARC review that suggested the case was more appropriate for PSARC. > [2] Dante server uses Solaris PAM for authentication which requires the > privileged user to be 'root'. Hence, the privileged user (i.e. root) > will have all the privileges even when not all of them are required. > This is not the current recommended practice, but is this acceptable at > all? A lot of the discussion has centered around here. I suppose the project team could just not support username/password authentication. If I read the Socks 5 RFC correctly, username/password is a "should." I don't know if that would be acceptable to the customer base or not. That said, one of the exported interfaces for all PAM applications is the service name. Perhaps I missed it in the exported interfaces. Stability should likely be no lower than Uncommitted. The service name is important and needs to be documented on the socksd man page so admins can configure pam.conf accordingly. Since the protocol is explicitly username followed by password, the service's PAM stack should be specified. You also probably want to specify the account stack. I'd expect to see this in the sockd(1m) man page. It may wish to also say something about pam_servicename in sockd.conf(4) and how that all applies. Furthermore, a project could create a PAM service module just to handle socks username/password authentication (and account management) that didn't need to be tied to the hosts passwd(4) and shadow(4) databases -- that may require no privilege. To do authentication and account management as appears in sockd:auth_pam.c should only require euid 0, privs = none, or euid = uid != 0, privs = file_dac_read. IMO, the PAM code in auth_pam.c exhibits confusion. I don't believe inet_ntoa() is a valid PAM_RHOST value. The project team should take Joep up on his offer to help, or any of the other folk on pam-core@sun.com. I believe the real (PAM) security issue is exposing the system users accounts to the internet. Safe programming (and running uid != 0, privs - file_dac_read) can ensure that whatever inputs are stuffed over the protocol do not meet with privilege escalation. However this does leave the system open to username and password probing attacks that are likely not audited. The project team may wish considering adding Solaris Audit calls to mitigate this exposure. A couple nits: > /usr/man/man4/sockd.conf.5 > /usr/man/man4/socks.conf.5 These should be sockd.conf.4 and socks.conf.5 > 4.7. Admin/Config Impact: > > The package will also provide template of configuration files > for both server and client. The templates for these configureation > files are attached. > > /etc/sockd.conf > /etc/socks.conf These samples don't seem to be in the case directory, or mail log. My download doesn't seem contain sample files either. Gary.. From gww@eng.sun.com Fri Nov 28 12:44:58 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mASKivHQ028507; Fri, 28 Nov 2008 12:44:58 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mASKilG5018466; Fri, 28 Nov 2008 20:44:56 GMT Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KB2007019MU4M00@nwk-avmta-1.sfbay.Sun.COM>; Fri, 28 Nov 2008 12:44:54 -0800 (PST) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KB2000C49MTNW20@nwk-avmta-1.sfbay.Sun.COM>; Fri, 28 Nov 2008 12:44:53 -0800 (PST) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mASKiosx034020; Fri, 28 Nov 2008 12:44:50 -0800 (PST) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id mASKiQOv005357; Fri, 28 Nov 2008 12:44:26 -0800 (PST) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id mASKiQal005356; Fri, 28 Nov 2008 12:44:26 -0800 (PST) Date: Fri, 28 Nov 2008 12:44:26 -0800 (PST) From: Gary Winiger Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] To: James.Gates@sun.com, psarc-ext@sun.com Cc: Mayuresh.Nirhali@sun.com, lsarc-ext@sun.com Message-id: <200811282044.mASKiQal005356@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 2954 I'm just getting back to this from the out of band LSARC review that suggested the case was more appropriate for PSARC. > [2] Dante server uses Solaris PAM for authentication which requires the > privileged user to be 'root'. Hence, the privileged user (i.e. root) > will have all the privileges even when not all of them are required. > This is not the current recommended practice, but is this acceptable at > all? A lot of the discussion has centered around here. I suppose the project team could just not support username/password authentication. If I read the Socks 5 RFC correctly, username/password is a "should." I don't know if that would be acceptable to the customer base or not. That said, one of the exported interfaces for all PAM applications is the service name. Perhaps I missed it in the exported interfaces. Stability should likely be no lower than Uncommitted. The service name is important and needs to be documented on the socksd man page so admins can configure pam.conf accordingly. Since the protocol is explicitly username followed by password, the service's PAM stack should be specified. You also probably want to specify the account stack. I'd expect to see this in the sockd(1m) man page. It may wish to also say something about pam_servicename in sockd.conf(4) and how that all applies. Furthermore, a project could create a PAM service module just to handle socks username/password authentication (and account management) that didn't need to be tied to the hosts passwd(4) and shadow(4) databases -- that may require no privilege. To do authentication and account management as appears in sockd:auth_pam.c should only require euid 0, privs = none, or euid = uid != 0, privs = file_dac_read. IMO, the PAM code in auth_pam.c exhibits confusion. I don't believe inet_ntoa() is a valid PAM_RHOST value. The project team should take Joep up on his offer to help, or any of the other folk on pam-core@sun.com. I believe the real (PAM) security issue is exposing the system users accounts to the internet. Safe programming (and running uid != 0, privs - file_dac_read) can ensure that whatever inputs are stuffed over the protocol do not meet with privilege escalation. However this does leave the system open to username and password probing attacks that are likely not audited. The project team may wish considering adding Solaris Audit calls to mitigate this exposure. A couple nits: > /usr/man/man4/sockd.conf.5 > /usr/man/man4/socks.conf.5 These should be sockd.conf.4 and socks.conf.5 > 4.7. Admin/Config Impact: > > The package will also provide template of configuration files > for both server and client. The templates for these configureation > files are attached. > > /etc/sockd.conf > /etc/socks.conf These samples don't seem to be in the case directory, or mail log. My download doesn't seem contain sample files either. Gary.. From carlsonj@phorcys.east.sun.com Mon Dec 1 05:49:42 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mB1DnfjW028337; Mon, 1 Dec 2008 05:49:42 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id mB1DnSgB014891; Mon, 1 Dec 2008 21:49:38 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KB70040NAEOT600@nwk-avmta-2.sfbay.sun.com>; Mon, 01 Dec 2008 05:49:36 -0800 (PST) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KB700LSIAENCB80@nwk-avmta-2.sfbay.sun.com>; Mon, 01 Dec 2008 05:49:36 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mB1DnYHL002055; Mon, 01 Dec 2008 08:49:34 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mB1DnYal002052; Mon, 01 Dec 2008 08:49:34 -0500 (EST) Date: Mon, 01 Dec 2008 08:49:34 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <200811282044.mASKiQal005356@marduk.eng.sun.com> To: Gary Winiger Cc: James.Gates@sun.com, psarc-ext@sun.com, Mayuresh.Nirhali@sun.com, lsarc-ext@sun.com Message-id: <18739.60270.867151.253792@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200811282044.mASKiQal005356@marduk.eng.sun.com> Status: RO Content-Length: 1550 Gary Winiger writes: > That said, one of the exported interfaces for all PAM applications > is the service name. Perhaps I missed it in the exported interfaces. > Stability should likely be no lower than Uncommitted. The service Agreed; that's missing. Looking at the code, that's "sockd" by default and can be overridden in the configuration file by using: pamservicename: new-name-here > Furthermore, a project could create a PAM service module just > to handle socks username/password authentication (and account > management) that didn't need to be tied to the hosts passwd(4) and > shadow(4) databases -- that may require no privilege. Yes, a future project could do that, but I think doing it would actually drain a good part of the usefulness of PAM, at least for this project. The problem is that administering users (and passwords) in a service-specific way scales poorly and is hard to manage. Even if it's not "clean," many administrators would rather have a central registry for all users authenticated by the system for all applications, so that when a user is added or removed, they don't have to hunt down all the places where this data is squirrelled away. Having per-service files greatly complicates matters, and virtually guarantees that something will be missed when changes are needed. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From carlsonj@phorcys.east.sun.com Mon Dec 1 05:49:42 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mB1DnfjW028337; Mon, 1 Dec 2008 05:49:42 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id mB1DnSgB014891; Mon, 1 Dec 2008 21:49:38 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KB70040NAEOT600@nwk-avmta-2.sfbay.sun.com>; Mon, 01 Dec 2008 05:49:36 -0800 (PST) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KB700LSIAENCB80@nwk-avmta-2.sfbay.sun.com>; Mon, 01 Dec 2008 05:49:36 -0800 (PST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mB1DnYHL002055; Mon, 01 Dec 2008 08:49:34 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mB1DnYal002052; Mon, 01 Dec 2008 08:49:34 -0500 (EST) Date: Mon, 01 Dec 2008 08:49:34 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <200811282044.mASKiQal005356@marduk.eng.sun.com> To: Gary Winiger Cc: James.Gates@sun.com, psarc-ext@sun.com, Mayuresh.Nirhali@sun.com, lsarc-ext@sun.com Message-id: <18739.60270.867151.253792@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200811282044.mASKiQal005356@marduk.eng.sun.com> Status: RO Content-Length: 1550 Gary Winiger writes: > That said, one of the exported interfaces for all PAM applications > is the service name. Perhaps I missed it in the exported interfaces. > Stability should likely be no lower than Uncommitted. The service Agreed; that's missing. Looking at the code, that's "sockd" by default and can be overridden in the configuration file by using: pamservicename: new-name-here > Furthermore, a project could create a PAM service module just > to handle socks username/password authentication (and account > management) that didn't need to be tied to the hosts passwd(4) and > shadow(4) databases -- that may require no privilege. Yes, a future project could do that, but I think doing it would actually drain a good part of the usefulness of PAM, at least for this project. The problem is that administering users (and passwords) in a service-specific way scales poorly and is hard to manage. Even if it's not "clean," many administrators would rather have a central registry for all users authenticated by the system for all applications, so that when a user is added or removed, they don't have to hunt down all the places where this data is squirrelled away. Having per-service files greatly complicates matters, and virtually guarantees that something will be missed when changes are needed. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Mayuresh.Nirhali@sun.com Wed Dec 3 01:08:14 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mB398C6G014592; Wed, 3 Dec 2008 01:08:13 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id mB3985bg026975; Wed, 3 Dec 2008 17:08:11 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KBA00C3CMPL7B00@brm-avmta-1.central.sun.com>; Wed, 03 Dec 2008 02:08:09 -0700 (MST) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KBA00ATUMPIVW00@brm-avmta-1.central.sun.com>; Wed, 03 Dec 2008 02:08:08 -0700 (MST) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mB3985V5029890; Wed, 03 Dec 2008 09:08:05 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KBA00G01MOAQ500@mail-apac.sun.com> (original mail from Mayuresh.Nirhali@Sun.COM); Wed, 03 Dec 2008 17:08:05 +0800 (SGT) Received: from [129.158.227.167] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KBA00C5AMPAWDMD@mail-apac.sun.com>; Wed, 03 Dec 2008 17:08:04 +0800 (SGT) Date: Wed, 03 Dec 2008 14:37:57 +0530 From: Mayuresh Nirhali Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <18739.60270.867151.253792@gargle.gargle.HOWL> Sender: Mayuresh.Nirhali@sun.com To: James Carlson Cc: Gary Winiger , James.Gates@sun.com, psarc-ext@sun.com, lsarc-ext@sun.com Message-id: <49364C6D.1050607@Sun.COM> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_neg25AIe/riohtgjnHdu6g)" X-PMX-Version: 5.4.1.325704 References: <200811282044.mASKiQal005356@marduk.eng.sun.com> <18739.60270.867151.253792@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.16 (X11/20080908) Status: RO Content-Length: 103067 This is a multi-part message in MIME format. --Boundary_(ID_neg25AIe/riohtgjnHdu6g) Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Thanks Gary and James, I have updated the man pages and attaching them here for further review. Also please find updated PSARC material attached with this mail. The material include the sample configuration files and updated one_pager & the proposal document. Please review and let me know your comments. I still have not received any response from the dante maintainers. I will start looking into creating a patch that will fix the Solaris issues with dante, ofcourse with help from some of you. Thanks Mayuresh James Carlson wrote: > Gary Winiger writes: > >> That said, one of the exported interfaces for all PAM applications >> is the service name. Perhaps I missed it in the exported interfaces. >> Stability should likely be no lower than Uncommitted. The service >> > > Agreed; that's missing. Looking at the code, that's "sockd" by > default and can be overridden in the configuration file by using: > > pamservicename: new-name-here > > >> Furthermore, a project could create a PAM service module just >> to handle socks username/password authentication (and account >> management) that didn't need to be tied to the hosts passwd(4) and >> shadow(4) databases -- that may require no privilege. >> > > Yes, a future project could do that, but I think doing it would > actually drain a good part of the usefulness of PAM, at least for this > project. > > The problem is that administering users (and passwords) in a > service-specific way scales poorly and is hard to manage. Even if > it's not "clean," many administrators would rather have a central > registry for all users authenticated by the system for all > applications, so that when a user is added or removed, they don't have > to hunt down all the places where this data is squirrelled away. > > Having per-service files greatly complicates matters, and virtually > guarantees that something will be missed when changes are needed. > > --Boundary_(ID_neg25AIe/riohtgjnHdu6g) Content-type: application/x-tar; name=danteman.tar Content-transfer-encoding: BASE64 Content-disposition: inline; filename=danteman.tar bWFuL21hbjEvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAADAwMDA3MTEAMDQwNzE1NgAwMDAwMDEyADAwMDAwMDAwMDAwADEwNzcyNDAz MDAyADAwMTI3NTcANQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAB1c3RhcgAwMG1uMTMzNzY2AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAc3RhZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwMTQ2 ADAwMDAwMDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABtYW4vbWFuMS9zb2Nrc2lm eS4xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDAwMDcxMQAwNDA3 MTU2ADAwMDAwMTIAMDAwMDAwMDMxNDcAMTExMTU0NDQ1MzYAMDAxNDcxNAAwAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AHVzdGFyADAwbW4xMzM3NjYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABzdGFmZgAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAwMDAxNDYAMDAwMDAwMwAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAC5cXCIgYXV0by1nZW5lcmF0ZWQgYnkgZG9jYm9vazJt YW4tc3BlYyAkUmV2aXNpb246IDEuMS4xLjEgJAouVEggIlNPQ0tTSUZZIiAiMSIg IjIwMDgtMDMtMjUiICJBcHBsaWNhdGlvbiIgIlNvY2tzIENsaWVudCBQcm9ncmFt IgouU0ggTkFNRQpzb2Nrc2lmeSBcLSBkeW5hbWljYWxseSBTT0NLU2lmaWVzIGEg cHJvZ3JhbQouU0ggU1lOT1BTSVMKXGZCc29ja3NpZnlcZlIgXGZCXGZJcHJvZ3Jh bVxmQlxmUiBbIFxmQlxmSWFyZ3VtZW50c1xmQlxmSVxmUiBdCi5TSCAiREVTQ1JJ UFRJT04iClxmQnNvY2tzaWZ5XGZSIGlzIERhbnRlJ3MgZXF1aXZhbGVudCBvZiB0 aGUgTkVDIFNPQ0tTJyBcZkJydW5zb2Nrc1xmUiwKc29ja3NpZnkgdXNlcyBcZkJM RF9QUkVMT0FEXGZSIGVudmlyb25tZW50IHZhcmlhYmxlIHRvIHdyYXAgYWxsIApu ZXR3b3JraW5nLXJlbGF0ZWQgc3lzdGVtIGNhbGxzIHNvIHRoYXQgcHJvZ3JhbXMg Y2FuIGdvIHRocm91Z2ggYSAKU09DS1Mgc2VydmVyIHRoYXQgd2FzIGluc3RhbGxl ZCBhcyBwYXJ0IG9mIGEgZmlyZXdhbGwuCi5QUApEYW50ZSBTT0NLUyBpbXBsZW1l bnRhdGlvbiBpcyBkZWxpdmVyZWQgYXMgcGFydCBvZiBmb2xsb3dpbmcgMiBwYWNr YWdlczoKLlBQClNVTldsaWJzb2NrcyAgRGFudGUgQ2xpZW50IGxpYnJhcmllcwou YnIKU1VOV2RhbnRlciAgICBEYW50ZSBTZXJ2ZXIgKHJvb3QpCi5icgpTVU5XZGFu dGV1ICAgIERhbnRlIFNlcnZlciAodXNlcikKLlBQCi5TSCAiT1BUSU9OUyIKLlBQ Ci5UUApcZkJcZklwcm9ncmFtXGZCXGZSClRoZSBwcm9ncmFtIHRoYXQgaXMgdG8g YmUgc29ja3NpZmllZC4gVGhlIFxmQlxmSWFyZ3VtZW50c1xmQlxmUiBhcmUgcHJv Z3JhbSAKYXJndW1lbnRzIHRvIHRoZSBwcm9ncmFtIGFuZCBub3QgdG8gc29ja3Np ZnkuCi5QUAouU0ggIkZJTEVTIgouUFAKLlRQClxmQi9ldGMvc29ja3MuY29uZlxm UgpEYW50ZSBjbGllbnQgY29uZmlndXJhdGlvbiBmaWxlLgouU0ggIkVYQU1QTEVT IgouUFAKVG8gY2hlY2tvdXQgYSBzdWJ2ZXJzaW9uIHJlcG9zaXRvcnkgZnJvbSBi ZWhpbmQgYSBmaXJld2FsbCwgRG8sCi5zcAoubmYKc29ja3NpZnkgc3ZuIGNvIDxz dm4tcmVwb3NpdG9yeS11cmw+Ci5zcAouZmkKLlBQCi5TSCAiU0VFIEFMU08iClxm QnNvY2tzLmNvbmZcZlIoNCksIFxmQnNvY2tkXGZSKDFtKSwgXGZCc29ja2QuY29u ZlxmUig0KQouU0ggIk5PVEVTIgouUFAKQSBtb3JlIHBlcm1hbmVudCBzb2x1dGlv biB3b3VsZCBiZSB0byBhZGQgdGhlICBMRF9QUkVMT0FEIGVudmlyb25tZW50IHZh bHVlIAp0byB0aGUgc2hlbGwgc3RhcnR1cCBmaWxlcy4gIFRoZW4gYWxsIG5vbi1z ZXRbdWddaWQgYXBwbGljYXRpb25zIHRoYXQgYXJlIApsaW5rZWQgZHluYW1pY2Fs bHkgd291bGQgYmUgc29ja3NpZmllZC4gIEhvd2V2ZXIgdGhpcyBjYW4gaGF2ZSBi YWQgc2lkZS1lZmZlY3RzLgouU0ggIkFVVEhPUiIKLlBQCkRhbnRlIHdhcyBkZXZl bG9wZWQgZm9yIEluZmVybm8gTmV0dHZlcmsgQS9TLCBOb3J3YXkgYnk6IE1pY2hh ZWwgU2h1bGRtYW4gPG1pY2hhZWxzQGluZXQubm8+OiAKRGVzaWduIGFuZCBpbXBs ZW1lbnRhdGlvbi4gLSBLYXJsLUFuZHI/IFNrZXZpayA8a2FybHNAaW5ldC5ubz46 IEF1dG9jb25mIGFuZCBwb3J0aW5nLgoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA bWFuL21hbjFtLwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAADAwMDA3MTEAMDQwNzE1NgAwMDAwMDEyADAwMDAwMDAwMDAwADExMTE1NDQ0 NTE2ADAwMTMxNDMANQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAB1c3RhcgAwMG1uMTMzNzY2AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAc3RhZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwMTQ2 ADAwMDAwMDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABtYW4vbWFuMW0vc29ja2Qu MW0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDAwMDYwMAAwNDA3 MTU2ADAwMDAwMTIAMDAwMDAwMTM0MjIAMTExMTU0NDQ1MTYAMDAxNDUwNwAwAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AHVzdGFyADAwbW4xMzM3NjYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABzdGFmZgAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAwMDAxNDYAMDAwMDAwMwAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAC5cIiAkSWQ6IHNvY2tkLjgsdiAxLjI5IDIwMDUvMDEv MjQgMTA6MjQ6MjAga2FybHMgRXhwICQKLlwiCi5cIiBDb3B5cmlnaHQgKGMpIDE5 OTcsIDE5OTgsIDE5OTksIDIwMDAsIDIwMDEsIDIwMDIsIDIwMDQKLlwiICAgICAg SW5mZXJubyBOZXR0dmVyayBBL1MsIE5vcndheS4gIEFsbCByaWdodHMgcmVzZXJ2 ZWQuCi5cIgouXCIgUmVkaXN0cmlidXRpb24gYW5kIHVzZSBpbiBzb3VyY2UgYW5k IGJpbmFyeSBmb3Jtcywgd2l0aCBvciB3aXRob3V0Ci5cIiBtb2RpZmljYXRpb24s IGFyZSBwZXJtaXR0ZWQgcHJvdmlkZWQgdGhhdCB0aGUgZm9sbG93aW5nIGNvbmRp dGlvbnMKLlwiIGFyZSBtZXQ6Ci5cIiAxLiBUaGUgYWJvdmUgY29weXJpZ2h0IG5v dGljZSwgdGhpcyBsaXN0IG9mIGNvbmRpdGlvbnMgYW5kIHRoZSBmb2xsb3dpbmcK LlwiICAgIGRpc2NsYWltZXIgbXVzdCBhcHBlYXIgaW4gYWxsIGNvcGllcyBvZiB0 aGUgc29mdHdhcmUsIGRlcml2YXRpdmUgd29ya3MKLlwiICAgIG9yIG1vZGlmaWVk IHZlcnNpb25zLCBhbmQgYW55IHBvcnRpb25zIHRoZXJlb2YsIGFzd2VsbCBhcyBp biBhbGwKLlwiICAgIHN1cHBvcnRpbmcgZG9jdW1lbnRhdGlvbi4KLlwiIDIuIEFs bCBhZHZlcnRpc2luZyBtYXRlcmlhbHMgbWVudGlvbmluZyBmZWF0dXJlcyBvciB1 c2Ugb2YgdGhpcyBzb2Z0d2FyZQouXCIgICAgbXVzdCBkaXNwbGF5IHRoZSBmb2xs b3dpbmcgYWNrbm93bGVkZ2VtZW50OgouXCIgICAgICBUaGlzIHByb2R1Y3QgaW5j bHVkZXMgc29mdHdhcmUgZGV2ZWxvcGVkIGJ5Ci5cIiAgICAgIEluZmVybm8gTmV0 dHZlcmsgQS9TLCBOb3J3YXkuCi5cIiAzLiBUaGUgbmFtZSBvZiB0aGUgYXV0aG9y IG1heSBub3QgYmUgdXNlZCB0byBlbmRvcnNlIG9yIHByb21vdGUgcHJvZHVjdHMK LlwiICAgIGRlcml2ZWQgZnJvbSB0aGlzIHNvZnR3YXJlIHdpdGhvdXQgc3BlY2lm aWMgcHJpb3Igd3JpdHRlbiBwZXJtaXNzaW9uLgouXCIKLlwiIFRISVMgU09GVFdB UkUgSVMgUFJPVklERUQgQlkgVEhFIEFVVEhPUiBgYEFTIElTJycgQU5EIEFOWSBF WFBSRVNTIE9SCi5cIiBJTVBMSUVEIFdBUlJBTlRJRVMsIElOQ0xVRElORywgQlVU IE5PVCBMSU1JVEVEIFRPLCBUSEUgSU1QTElFRCBXQVJSQU5USUVTCi5cIiBPRiBN RVJDSEFOVEFCSUxJVFkgQU5EIEZJVE5FU1MgRk9SIEEgUEFSVElDVUxBUiBQVVJQ T1NFIEFSRSBESVNDTEFJTUVELgouXCIgSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFV VEhPUiBCRSBMSUFCTEUgRk9SIEFOWSBESVJFQ1QsIElORElSRUNULAouXCIgSU5D SURFTlRBTCwgU1BFQ0lBTCwgRVhFTVBMQVJZLCBPUiBDT05TRVFVRU5USUFMIERB TUFHRVMgKElOQ0xVRElORywgQlVUCi5cIiBOT1QgTElNSVRFRCBUTywgUFJPQ1VS RU1FTlQgT0YgU1VCU1RJVFVURSBHT09EUyBPUiBTRVJWSUNFUzsgTE9TUyBPRiBV U0UsCi5cIiBEQVRBLCBPUiBQUk9GSVRTOyBPUiBCVVNJTkVTUyBJTlRFUlJVUFRJ T04pIEhPV0VWRVIgQ0FVU0VEIEFORCBPTiBBTlkKLlwiIFRIRU9SWSBPRiBMSUFC SUxJVFksIFdIRVRIRVIgSU4gQ09OVFJBQ1QsIFNUUklDVCBMSUFCSUxJVFksIE9S IFRPUlQKLlwiIChJTkNMVURJTkcgTkVHTElHRU5DRSBPUiBPVEhFUldJU0UpIEFS SVNJTkcgSU4gQU5ZIFdBWSBPVVQgT0YgVEhFIFVTRSBPRgouXCIgVEhJUyBTT0ZU V0FSRSwgRVZFTiBJRiBBRFZJU0VEIE9GIFRIRSBQT1NTSUJJTElUWSBPRiBTVUNI IERBTUFHRS4KLlwiCi5cIiBJbmZlcm5vIE5ldHR2ZXJrIEEvUyByZXF1ZXN0cyB1 c2VycyBvZiB0aGlzIHNvZnR3YXJlIHRvIHJldHVybiB0bwouXCIKLlwiICBTb2Z0 d2FyZSBEaXN0cmlidXRpb24gQ29vcmRpbmF0b3IgIG9yICBzZGNAaW5ldC5ubwou XCIgIEluZmVybm8gTmV0dHZlcmsgQS9TCi5cIiAgT3NsbyBSZXNlYXJjaCBQYXJr Ci5cIiAgR2F1c3RhZGFsbOllbiAyMQouXCIgIE5PLTAzNDkgT3NsbwouXCIgIE5v cndheQouXCIKLlwiIGFueSBpbXByb3ZlbWVudHMgb3IgZXh0ZW5zaW9ucyB0aGF0 IHRoZXkgbWFrZSBhbmQgZ3JhbnQgSW5mZXJubyBOZXR0dmVyayBBL1MKLlwiIHRo ZSByaWdodHMgdG8gcmVkaXN0cmlidXRlIHRoZXNlIGNoYW5nZXMuCi5cIgouVEgg U09DS0QgMW0gIk5vdiAyOCwgMjAwOCIKLlNIIE5BTUUKc29ja2QgXC0gTmV0d29y ayBTT0NLUyBzZXJ2ZXIKLlNIIFNZTk9QU0lTCi5CIHNvY2tkCi5SQiBbIFwtRExW ZGhudiBdCi5SQiBbIFwtTgouSVIgbnVtYmVyIF0KLlJCIFsgXC1mCi5JUiBmaWxl IF0KLlNIIERFU0NSSVBUSU9OCi5CIERhbnRlCmltcGxlbWVudHMgdGhlIHNvY2tz IHN0YW5kYXJkIGFuZCBjYW4gZnVuY3Rpb24gYXMgYSBmaXJld2FsbCBiZXR3ZWVu IG5ldHdvcmtzLgouUFAKLkIgRGFudGUKcmVsYXlzIFRDUCBhbmQgVURQIGJvdGgg ZnJvbSBvdXRzaWRlIHRoZSBuZXR3b3JrIGFuZCBpbiwgYW5kIGZyb20gaW5zaWRl CmFuZCBvdXQuCi5QUApEYW50ZSBzZXJ2ZXIgY2FuIGJlIGFkbWluaXN0ZXJlZCB1 c2luZyB0aGUgZGVmYXVsdCBTTUYgc2VydmljZS4gRm9yCmRhbnRlIHNlcnZlciB0 byBzdGFydCBzdWNjZXNzZnVsbHksIHRoZSBzZXJ2ZXIgY29uZmlndXJhdGlvbiBm aWxlIG11c3QgYmUgCnBvcHVsYXRlZCB3aXRoIGF0bGVhc3QgdGhlIG5lY2Vzc2Fy eSBpbmZvcm1hdGlvbiAoZS5nLiB0aGUgbmV0d29yayBkZXZpY2Ugd2l0aAp3aGlj aCBkYW50ZSBzZXJ2ZXIgd291bGQgb3BlcmF0ZSkuIElmIHRoZSBzZXJ2ZXIgY29u ZmlndXJhdGlvbiBmaWxlIGlzIG5vdCB1cGRhdGVkLCB0aGVuIHRoZSBTTUYgc2Vy dmljZSBnb2VzIGludG8gbWFpbnRhaW5hbmNlIG1vZGUgd2hlbiBlbmFibGVkLgou UFAKRGFudGUgU09DS1MgaW1wbGVtZW50YXRpb24gaXMgZGVsaXZlcmVkIGFzIHBh cnQgb2YgZm9sbG93aW5nIDMgcGFja2FnZXM6Ci5QUApTVU5XbGlic29ja3MgIERh bnRlIENsaWVudCBsaWJyYXJpZXMKLmJyClNVTldkYW50ZXIgICAgRGFudGUgU2Vy dmVyIChSb290KQouYnIKU1VOV2RhbnRldSAgICBEYW50ZSBTZXJ2ZXIgKFVzZXIp Ci5QUApUaGUgU1VOV2RhbnRlciBwYWNrYWdlIGFsc28gaW5zdGFsbHMgdGhlIGZv bGxvd2luZyBTTUYKZmlsZXMgdG8gZmFjaWxpdGF0ZSBzZXJ2aWNlIG1hbmFnZW1l bnQgKHJlZmVyIHRvIHNtZig1KQphbmQgdGhlIFNNRiBzZWN0aW9uIGJlbG93KToK LlJTCi5QUApUaGUgb3B0aW9ucyBhcmUgYXMgZm9sbG93czoKLlRQCi5CIFwtRAou QiBEYW50ZQp3aWxsIGRldGFjaCBmcm9tIHRoZSBjb250cm9sbGluZyB0ZXJtaW5h bCBhbmQgcnVuIGluCnRoZSBiYWNrZ3JvdW5kIGFzIGEgc3lzdGVtIGRhZW1vbi4g VGhlIGRlZmF1bHQgU01GIHNlcnZpY2UKdXNlcyB0aGlzIG9wdGlvbiB0byBzdGFy dCB0aGUgZGFudGUgc2VydmVyLgouVFAKLkIgXC1MCkRpc3BsYXlzIHRoZSBsaWNl bnNlCi5CIERhbnRlCmNvbWVzIHVuZGVyLgouVFAKLkJJIFwtTiBudW1iZXIKLkIg RGFudGUKd2lsbCBmb3JrIG9mCi5JIG51bWJlcgpjb3BpZXMgb2YgaXRzZWxmIHdo ZW4gc3RhcnRpbmcuICBDYW4gYmUgdXNlZCBmb3IgdmVyeSBidXN5IHNlcnZlcnMu Ci5UUAouQiBcLVYKVmVyaWZpZXMgY29uZmlnIGZpbGUgYW5kIGV4aXRzLgouVFAK LkIgXC1kCkVuYWJsZXMgZGVidWdnaW5nLgouVFAKLkJJIFwtZiBmaWxlCi5CIERh bnRlCndpbGwgcmVhZCBpdHMgY29uZmlndXJhdGlvbiBmcm9tCi5JUiBmaWxlIC4K LlRQCi5CIFwtaApTaG93cyB0aGUgY3VycmVudGx5IHZhbGlkIG9wdGlvbnMuCi5U UAouQiBcLW4KRGlzYWJsZXMgVENQIGtlZXAtYWxpdmUgbWVzc2FnZXMuICBOb3Jt YWxseQouQiBEYW50ZQplbmFibGVzIFRDUCBrZWVwLWFsaXZlIG1lc3NhZ2VzIHNv IHRoYXQgY29ubmVjdGlvbnMgZnJvbSBtYWNoaW5lcyB0aGF0CmhhdmUgY3Jhc2hl ZCBvciBmb3Igb3RoZXIgcmVhc29ucyBubyBsb25nZXIgY2FuIGJlIHJlYWNoZWQg dGltZSBvdXQuCi5UUAouQiBcLXYKRGlzcGxheXMKLkIgRGFudGUKdmVyc2lvbi4K LlNIIEVOVklST05NRU5UCi5UUAouQiBUTVBESVIKVXNlCi5CIFRNUERJUgpmb3Ig dGVtcG9yYXJ5IGZpbGVzLiAgU2luY2UKLkIgRGFudGUKdXNlcyBsb2NrZmlsZXMg aXQgaXMgcmVjb21tZW5kZWQgdGhhdAouQiBUTVBESVIKYmUgc2V0IHRvIGEgKGxv Y2FsKSBmaWxlc3lzdGVtIHdpdGggbG93IGxhdGVuY3kuCi5QUAouVFAKLkIgU09D S1NfVVNFUk5BTUUKVGhlIHNvY2tzIHVzZXJuYW1lIHVzZWQgZm9yIGF1dGhlbnRp Y2F0aW9uLgouUFAKLlRQCi5CIFNPQ0tTX1BBU1NXT1JEClBhc3N3b3JkIHVzZWQg Zm9yIGF1dGhlbnRpY2F0aW9uIHdpdGgKLkIgU09DS1NfVVNFUk5BTUUKLlNIIEZJ TEVTCi5UUAovZXRjL3NvY2tkLmNvbmYKLkIgRGFudGUKc2VydmVyIGNvbmZpZ3Vy YXRpb24gZmlsZS4KLlNIIFNFQ1VSSVRZCnNvY2tkLCBvciB0aGUgZGFudGUgU09D S1Mgc2VydmVyLCBzdXBwb3J0cyBmb2xsb3dpbmcgdXNlciBhdXRoZW50aWNhdGlv biAKbWVjaGFuaXNtcyBwcm92aWRlZCBieSBTb2xhcmlzLAouVFAKLkIgdXNlcm5h bWUsIHJmYywgcGFtKDNQQU0pIAouUFAKVGhlIHNlcnZlciBjb25maWd1cmF0aW9u IGZpbGUgZGVmaW5lcyB0d28gdmFyaWFibGVzIGFzLCB1c2VyLnByaXZpbGVnZWQK YW5kIHVzZXIubm90cHJpdmlsZWdlZC4gVGhlc2UgMiB2YXJpYWJsZXMgY2FuIGhh dmUgYSBsaXN0IG9mIHVzZXJpZHMgc2VwYXJhdGVkCmJ5IGNvbW1hLiBUaGUgc2Vy dmVyIGltcGxlbWVudGF0aW9uIGNhbGxzIHNldGV1aWQgZnVuY3Rpb24gdG8gc3dp dGNoIGJldHdlZW4KcHJpdmlsZWdlZCBhbmQgbm90cHJpdmlsZWdlZCB1c2Vycy4g VXBvbiBzdGFydCwgdGhlIHNlcnZlciBzd2l0Y2hlcyB0aGUKZWZmZWN0aXZlIGlk IGZyb20gdGhlIHVzZXIgd2hvIHN0YXJ0ZWQgdGhlIHNlcnZlciB0byB0aGUgc3Bl Y2lmaWVkIAp1c2VyLm5vdHByaXZpbGVnZWQuIExhdGVyLCBmb3IgYWxsIHRoZSBw cml2aWxlZ2VkIG9wZXJhdGlvbnMgKGUuZy4gUEFNIAphdXRoZW50aWNhdGlvbiks IHRoZSBzZXJ2ZXIgc2V0cyB0aGUgZWZmZWN0aXZlIHVzZXIgSUQgZnJvbSB1c2Vy Lm5vdHByaXZpbGVnZWQgCnRvIHNwZWNpZmllZCB1c2VyLnByaXZpbGVnZWQgYnkg Y2FsbGluZyBzZXRldWlkIGZ1bmN0aW9uLgouc3AKLkxQCkZvciBzb2NrZCB1c2Vy IGF1dGhlbnRpY2F0aW9uIHR5cGUsIFxmQnBhbVxmUjsgdGhlIHJlcXVpcmVkIFBB TSBzZXJ2aWNlbmFtZSBpcwpcZkJzb2NrZFxmUi4gVGhlIGRlZmF1bHQgUEFNIHNl cnZpY2Ugc3RhY2sgdG8gYmUgZGVmaW5lZCBpbiAvZXRjL3BhbS5jb25mIGlzIGFz IApiZWxvdywKLnNwCi5MUApzb2NrZAlhdXRoCXJlcXVpc2l0ZQlwYW1fYXV0aHRv a19nZXQuc28uMQpzb2NrZAlhdXRoCXJlcXVpcmVkCXBhbV9kaGtleXMuc28uMQpz b2NrZAlhdXRoCXJlcXVpcmVkCXBhbV91bml4X2NyZWQuc28uMQpzb2NrZAlhdXRo CXJlcXVpcmVkCXBhbV91bml4X2F1dGguc28uMQouU0ggQVVUSE9SUwpGb3IgSW5m ZXJubyBOZXR0dmVyayBBL1MsIE5vcndheToKIE1pY2hhZWwgU2h1bGRtYW4gPG1p Y2hhZWxzQGluZXQubm8+OiBEZXNpZ24gYW5kIGltcGxlbWVudGF0aW9uLgogS2Fy bC1BbmRyZScgU2tldmlrIDxrYXJsc0BpbmV0Lm5vPjogQXV0b2NvbmYgYW5kIHBv cnRpbmcuCi5TSCBTRUUgQUxTTwpcZkJzb2NrZC5jb25mXGZSKDQpLCBcZkJzb2Nr c2lmeVxmUigxKSwgXGZCc29ja3MuY29uZlxmUig0KQouUFAKSW5mb3JtYXRpb24g YWJvdXQgbmV3IHJlbGVhc2VzIGFuZCBvdGhlciByZWxhdGVkIGlzc3VlcyBjYW4g YmUgZm91bmQKb24gdGhlCi5CIERhbnRlCldXVyBob21lIHBhZ2UgYXQgaHR0cDov L3d3dy5pbmV0Lm5vL2RhbnRlLgouU0ggQlVHUwpTZWUgdGhlIGFjY29tcGFueWlu ZyBCVUdTIGZpbGUuICBOZXcgb25lcyBzaG91bGQgYmUgcmVwb3J0ZWQgdG8KZGFu dGVcLWJ1Z3NAaW5ldC5uby4KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAG1hbi9tYW40LwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwNzExADA0MDcxNTYAMDAwMDAxMgAwMDAw MDAwMDAwMAAxMTExNTQ0NTQ3MwAwMDEyNzc0ADUAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdXN0YXIAMDBtbjEzMzc2 NgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHN0YWZmAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAMDAwMDE0NgAwMDAwMDAzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA bWFuL21hbjQvc29ja3MuY29uZi40AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAADAwMDA2MDAAMDQwNzE1NgAwMDAwMDEyADAwMDAwMDEyNzEyADExMTE1NDQ0 NDUwADAwMTUxMjQAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAB1c3RhcgAwMG1uMTMzNzY2AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAc3RhZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwMTQ2 ADAwMDAwMDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuXCIgJElkOiBzb2Nrcy5j b25mLjUsdiAxLjI3IDIwMDUvMTIvMTkgMTQ6MjI6MTYgbWljaGFlbHMgRXhwICQK LlwiCi5cIiBDb3B5cmlnaHQgKGMpIDE5OTcsIDE5OTgsIDE5OTksIDIwMDAsIDIw MDEsIDIwMDMKLlwiICAgICAgSW5mZXJubyBOZXR0dmVyayBBL1MsIE5vcndheS4g IEFsbCByaWdodHMgcmVzZXJ2ZWQuCi5cIgouXCIgUmVkaXN0cmlidXRpb24gYW5k IHVzZSBpbiBzb3VyY2UgYW5kIGJpbmFyeSBmb3Jtcywgd2l0aCBvciB3aXRob3V0 Ci5cIiBtb2RpZmljYXRpb24sIGFyZSBwZXJtaXR0ZWQgcHJvdmlkZWQgdGhhdCB0 aGUgZm9sbG93aW5nIGNvbmRpdGlvbnMKLlwiIGFyZSBtZXQ6Ci5cIiAxLiBUaGUg YWJvdmUgY29weXJpZ2h0IG5vdGljZSwgdGhpcyBsaXN0IG9mIGNvbmRpdGlvbnMg YW5kIHRoZSBmb2xsb3dpbmcKLlwiICAgIGRpc2NsYWltZXIgbXVzdCBhcHBlYXIg aW4gYWxsIGNvcGllcyBvZiB0aGUgc29mdHdhcmUsIGRlcml2YXRpdmUgd29ya3MK LlwiICAgIG9yIG1vZGlmaWVkIHZlcnNpb25zLCBhbmQgYW55IHBvcnRpb25zIHRo ZXJlb2YsIGFzd2VsbCBhcyBpbiBhbGwKLlwiICAgIHN1cHBvcnRpbmcgZG9jdW1l bnRhdGlvbi4KLlwiIDIuIEFsbCBhZHZlcnRpc2luZyBtYXRlcmlhbHMgbWVudGlv bmluZyBmZWF0dXJlcyBvciB1c2Ugb2YgdGhpcyBzb2Z0d2FyZQouXCIgICAgbXVz dCBkaXNwbGF5IHRoZSBmb2xsb3dpbmcgYWNrbm93bGVkZ2VtZW50OgouXCIgICAg ICBUaGlzIHByb2R1Y3QgaW5jbHVkZXMgc29mdHdhcmUgZGV2ZWxvcGVkIGJ5Ci5c IiAgICAgIEluZmVybm8gTmV0dHZlcmsgQS9TLCBOb3J3YXkuCi5cIiAzLiBUaGUg bmFtZSBvZiB0aGUgYXV0aG9yIG1heSBub3QgYmUgdXNlZCB0byBlbmRvcnNlIG9y IHByb21vdGUgcHJvZHVjdHMKLlwiICAgIGRlcml2ZWQgZnJvbSB0aGlzIHNvZnR3 YXJlIHdpdGhvdXQgc3BlY2lmaWMgcHJpb3Igd3JpdHRlbiBwZXJtaXNzaW9uLgou XCIKLlwiIFRISVMgU09GVFdBUkUgSVMgUFJPVklERUQgQlkgVEhFIEFVVEhPUiBg YEFTIElTJycgQU5EIEFOWSBFWFBSRVNTIE9SCi5cIiBJTVBMSUVEIFdBUlJBTlRJ RVMsIElOQ0xVRElORywgQlVUIE5PVCBMSU1JVEVEIFRPLCBUSEUgSU1QTElFRCBX QVJSQU5USUVTCi5cIiBPRiBNRVJDSEFOVEFCSUxJVFkgQU5EIEZJVE5FU1MgRk9S IEEgUEFSVElDVUxBUiBQVVJQT1NFIEFSRSBESVNDTEFJTUVELgouXCIgSU4gTk8g RVZFTlQgU0hBTEwgVEhFIEFVVEhPUiBCRSBMSUFCTEUgRk9SIEFOWSBESVJFQ1Qs IElORElSRUNULAouXCIgSU5DSURFTlRBTCwgU1BFQ0lBTCwgRVhFTVBMQVJZLCBP UiBDT05TRVFVRU5USUFMIERBTUFHRVMgKElOQ0xVRElORywgQlVUCi5cIiBOT1Qg TElNSVRFRCBUTywgUFJPQ1VSRU1FTlQgT0YgU1VCU1RJVFVURSBHT09EUyBPUiBT RVJWSUNFUzsgTE9TUyBPRiBVU0UsCi5cIiBEQVRBLCBPUiBQUk9GSVRTOyBPUiBC VVNJTkVTUyBJTlRFUlJVUFRJT04pIEhPV0VWRVIgQ0FVU0VEIEFORCBPTiBBTlkK LlwiIFRIRU9SWSBPRiBMSUFCSUxJVFksIFdIRVRIRVIgSU4gQ09OVFJBQ1QsIFNU UklDVCBMSUFCSUxJVFksIE9SIFRPUlQKLlwiIChJTkNMVURJTkcgTkVHTElHRU5D RSBPUiBPVEhFUldJU0UpIEFSSVNJTkcgSU4gQU5ZIFdBWSBPVVQgT0YgVEhFIFVT RSBPRgouXCIgVEhJUyBTT0ZUV0FSRSwgRVZFTiBJRiBBRFZJU0VEIE9GIFRIRSBQ T1NTSUJJTElUWSBPRiBTVUNIIERBTUFHRS4KLlwiCi5cIiBJbmZlcm5vIE5ldHR2 ZXJrIEEvUyByZXF1ZXN0cyB1c2VycyBvZiB0aGlzIHNvZnR3YXJlIHRvIHJldHVy biB0bwouXCIKLlwiICBTb2Z0d2FyZSBEaXN0cmlidXRpb24gQ29vcmRpbmF0b3Ig IG9yICBzZGNAaW5ldC5ubwouXCIgIEluZmVybm8gTmV0dHZlcmsgQS9TCi5cIiAg T3NsbyBSZXNlYXJjaCBQYXJrCi5cIiAgR2F1c3RhZGFsbOllbiAyMQouXCIgIE5P LTAzNDkgT3NsbwouXCIgIE5vcndheQouXCIKLlwiIGFueSBpbXByb3ZlbWVudHMg b3IgZXh0ZW5zaW9ucyB0aGF0IHRoZXkgbWFrZSBhbmQgZ3JhbnQgSW5mZXJubyBO ZXR0dmVyayBBL1MKLlwiIHRoZSByaWdodHMgdG8gcmVkaXN0cmlidXRlIHRoZXNl IGNoYW5nZXMuCi5cIgouVEggU09DS1MuQ09ORiA1ICJGZWJydWFyeSAxNywgMjAw MSIKLlNIIE5BTUUKc29ja3MuY29uZiBcLSBzb2NrcyBjbGllbnQgY29uZmlndXJh dGlvbiBmaWxlIHN5bnRheAouU0ggREVTQ1JJUFRJT04KVGhlIGNvbmZpZ3VyYXRp b24gZmlsZSBmb3IgdGhlIHNvY2tzIGNsaWVudCBsaWJyYXJ5IGFsbG93IGNvbnRy b2wgb3Zlcgpsb2dnaW5nIGFuZCBzZXJ2ZXIgc2VsZWN0aW9uLiAgSXQgaXMgZGl2 aWRlZCBpbnRvIHR3byBwYXJ0cywKbWlzY2VsbGFuZW91cyBzZXR0aW5ncyBhbmQg cm91dGVzLiAgQSBsaW5lIGNhbiBiZSBjb21tZW50ZWQgdXNpbmcgdGhlCnN0YW5k YXJkIGNvbW1lbnQgY2hhcmFjdGVyIFxmQiNcZlAuCi5TSCBGT1JNQVQKVGhlIG1p c2NlbGxhbmVvdXMgc2V0dGluZ3MgaGF2ZSBhIGtleXdvcmQgZm9sbG93ZWQgYnkg YSBjb2xvbiBhbmQgdGhlCnZhbHVlLgouVFAKXGZCZGVidWdcZlAKU2V0dGluZyB0 aGlzIGZpZWxkIHRvIDEgdHVybnMgb24gZGVidWdnaW5nLgouVFAKXGZCbG9nb3V0 cHV0XGZQClRoaXMgdmFsdWUgY29udHJvbHMgd2hlcmUgdGhlIHNlbmRzIGxvZ291 dHB1dC4gIEl0IGNhbgpiZSBlaXRoZXIgXGZCc3lzbG9nXGZQLCBcZkJzdGRvdXRc ZlAsIFxmQnN0ZGVyclxmUCwgYSBmaWxlbmFtZSwgb3IKYSBjb21iaW5hdGlvbi4K LklQIFxmQnJlc29sdmVwcm90b2NvbFxmUApUaGUgcHJvdG9jb2wgdXNlZCB0byBy ZXNvbHZlIGhvc3RuYW1lcy4KVmFsaWQgdmFsdWVzIGFyZSBcZkJ1ZHBcZlAgKGRl ZmF1bHQpLCBcZkJ0Y3BcZlAgYW5kIFxmQmZha2VcZlAuCi5UUAouU0ggUk9VVEVT ClRoZSByb3V0ZXMgYXJlIHNwZWNpZmllZCB3aXRoIGEgXGZCcm91dGVcZlAga2V5 d29yZC4KSW5zaWRlIGEgcGFpciBvZiBwYXJlbnMgKHt9KSBhIHNldCBvZiBrZXl3 b3JkcyBjb250cm9sIHRoZSBiZWhhdmlvciBvZgp0aGUgcm91dGUuCkVhY2ggXGZC cm91dGVcZlAgY2FuIGNvbnRhaW4KdGhyZWUgYWRkcmVzcyBzcGVjaWZpY2F0aW9u czsgXGZCZnJvbVxmUCwgXGZCdG9cZlAgYW5kIFxmQnZpYVxmUC4KQSByb3V0ZSBp cyBzZWxlY3RlZCBmb3IgYSBjb25uZWN0aW9uIGJhc2VkIG9uIHRoZSB2YWx1ZXMg d2l0aGluIHRoZQpcZkJyb3V0ZVxmUCBibG9jay4gIFRoZSBcZkJyb3V0ZVxmUCBi bG9jayBjYW4gY29udGFpbiB0aGUgZm9sbG93aW5nOgouVFAKLlNIIEFERFJFU1NF UwpFYWNoIGFkZHJlc3MgZmllbGQgY2FuIGNvbnNpc3Qgb2YgYSBpcGFkZHJlc3Mg KGFuZCB3aGVyZSBtZWFuaW5nZnVsLAphIG5ldG1hc2ssIHNlcGFyYXRlZCBmcm9t IHRoZSBpcGFkZHJlc3MgYnkgYSAnXGZCL1xmUCcgc2lnbi4pLCBhIGhvc3RuYW1l LApvciBhIGRvbWFpbm5hbWUgKGRlc2lnbmF0ZWQgYnkgdGhlIGxlYWRpbmcgJ1xm Qi5cZlAnKS4KRWFjaCBhZGRyZXNzIGNhbiBiZSBmb2xsb3dlZCBieSBhIG9wdGlv bmFsIFxmQnBvcnRcZlAgc3BlY2lmaWVyLgoKLklQIFxmQmZyb21cZlAKVGhlIHJv dXRlIGlzIHVzZWQgb25seSBieSByZXF1ZXN0cyBjb21pbmcgZnJvbSB0aGUgYWRk cmVzcyBnaXZlbiBhcyB2YWx1ZS4KLklQIFxmQnRvXGZQClRoZSByb3V0ZSBpcyB1 c2VkIG9ubHkgYnkgcmVxdWVzdHMgZ29pbmcgdG8gdGhlIGFkZHJlc3MgZ2l2ZW4g YXMgdmFsdWUuCi5JUCBcZkJ2aWFcZlAKQWRkcmVzcyBvZiBzb2NrcyBzZXJ2ZXIg dG8gYmUgdXNlZCBmb3IgdGhlIGNvbm5lY3Rpb24uCi5JUCBcZkJwb3J0XGZQClBh cmFtZXRlciB0byBcZkJmcm9tXGZQLCBcZkJ0b1xmUCBhbmQgXGZCdmlhXGZQLiAg QWNjZXB0cyB0aGUga2V5d29yZHMKXGZCZXEvPSwgbmVxLyE9LCBnZS8+PSwgbGUv PD0sIGd0Lz4sIGx0LzxcZlAgZm9sbG93ZWQgYnkgYSBudW1iZXIuCkEgcG9ydHJh bmdlIGNhbiBhbHNvIGJlIGdpdmVuIGFzICJwb3J0IDxzdGFydCAjPiAtIDxlbmQg Iz4iLCB3aGljaAp3aWxsIG1hdGNoIGFsbCBwb3J0IG51bWJlcnMgd2l0aGluIHRo ZSByYW5nZSA8c3RhcnQgIz4gYW5kIDxlbmQgIz4uCi5JUCBcZkJjb21tYW5kXGZQ ClRoZSBzZXJ2ZXIgc3VwcG9ydHMgdGhlIGdpdmVuIGNvbW1hbmRzLiAgVmFsaWQg Y29tbWFuZHMKYXJlIFxmQmJpbmRcZlAsIFxmQmJpbmRyZXBseVxmUCwgXGZCY29u bmVjdFxmUCwgXGZCdWRwYXNzb2NpYXRlXGZQCmFuZCBcZkJ1ZHByZXBseVxmUC4g CmFuZCBcZkJ1ZHByZXBseVxmUC4gIENhbiBiZSB1c2VkIGluc3RlYWQgb2YsIG9y IHRvIGNvbXBsZW1lbnQsClxmQnByb3RvY29sXGZQLgouSVAgXGZCbWV0aG9kXGZQ Ckxpc3Qgb2YgYXV0aGVudGljYXRpb24gbWV0aG9kcyB0aGUgXGZCY2xpZW50XGZQ IHN1cHBvcnRzIGFuZCB3aGljaCB0bwpvZmZlciB0aGUgc2VydmVyLiAgQ3VycmVu dGx5IHN1cHBvcnRlZCB2YWx1ZXMgYXJlIFxmQm5vbmVcZlAgYW5kClxmQnVzZXJu YW1lXGZQLgouSVAgXGZCcHJvdG9jb2xcZlAKVGhlIHByb3RvY29scyB0aGUgc2Vy dmVyIHN1cHBvcnRzLgpTdXBwb3J0ZWQgdmFsdWVzIGFyZSBcZkJ0Y3BcZlAgYW5k IFxmQnVkcFxmUC4KLklQIFxmQnByb3h5cHJvdG9jb2xcZlAKVGhlIHByb3h5IHBy b3RvY29scyB0aGUgc2VydmVyIHN1cHBvcnRzLgpDdXJyZW50bHkgc3VwcG9ydGVk IHZhbHVlcyBhcmUgXGZCc29ja3NfdjRcZlAsIFxmQnNvY2tzX3Y1XGZQLAphbmQg XGZCaHR0cF92MS4wXGZQLgouU0ggRVhBTVBMRVMKU2VlIHRoZSBleGFtcGxlIGRp cmVjdG9yeSBpbiB0aGUgZGlzdHJpYnV0aW9uLgouU0ggRU5WSVJPTk1FTlQKLlRQ ClxmQlNPQ0tTX1VTRVJOQU1FXGZQClVzZSBcZkJTT0NLU19VU0VSTkFNRVxmUCBh cyB0aGUgdXNlcm5hbWUgd2hlbiBkb2luZyB1c2VybmFtZQphdXRoZW50aWNhdGlv bi4KLlRQClxmQlNPQ0tTX1BBU1NXT1JEXGZQClVzZSBcZkJTT0NLU19QQVNTV09S RFxmUCBhcyB0aGUgcGFzc3dvcmQgd2hlbiBkb2luZyB1c2VybmFtZQphdXRoZW50 aWNhdGlvbi4gIE5vdCByZWNvbW1lbmRlZCBhcyBvdGhlciB1c2VycyBvbiB0aGUg c3lzdGVtIAptaWdodCBiZSBhYmxlIHRvIHNlZSB5b3VyIHBhc3N3b3JkLgouU0gg RklMRVMKLkkgL2V0Yy9zb2Nrcy5jb25mCi5TSCBBVVRIT1JTCkZvciBJbmZlcm5v IE5ldHR2ZXJrIEEvUywgTm9yd2F5OgogTWljaGFlbCBTaHVsZG1hbiA8bWljaGFl bHNAaW5ldC5ubz46IERlc2lnbiBhbmQgaW1wbGVtZW50YXRpb24uCiBLYXJsLUFu ZHJlJyBTa2V2aWsgPGthcmxzQGluZXQubm8+OiBBdXRvY29uZiBhbmQgcG9ydGlu Zy4KLlNIIFNFRSBBTFNPCnNvY2tkKDFtKSBzb2NrZC5jb25mKDQpIHNvY2tzaWZ5 KDEpIAouUHAKSW5mb3JtYXRpb24gYWJvdXQgbmV3IHJlbGVhc2VzIGFuZCBvdGhl ciByZWxhdGVkIGlzc3VlcyBjYW4gYmUgZm91bmQKb24gdGhlClxmQkRhbnRlXGZQ CldXVyBob21lIHBhZ2UgYXQgaHR0cDovL3d3dy5pbmV0Lm5vL2RhbnRlLgouU0gg QlVHUwpTZWUgdGhlIGFjY29tcGFueWluZyBCVUdTIGZpbGUuICBOZXcgb25lcyBz aG91bGQgYmUgcmVwb3J0ZWQgdG8KZGFudGVcLWJ1Z3NAaW5ldC5uby4KAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA bWFuL21hbjQvc29ja2QuY29uZi40AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAADAwMDA2MDAAMDQwNzE1NgAwMDAwMDEyADAwMDAwMDMzMTYyADExMTE1NDQ0 NDEwADAwMTUxMDMAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAB1c3RhcgAwMG1uMTMzNzY2AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAc3RhZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwMTQ2 ADAwMDAwMDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuXCIgJElkOiBzb2NrZC5j b25mLjUsdiAxLjcxIDIwMDYvMDEvMjAgMTI6NTk6MDkgbWljaGFlbHMgRXhwICQK LlwiCi5cIiBDb3B5cmlnaHQgKGMpIDE5OTcsIDE5OTgsIDE5OTksIDIwMDAsIDIw MDEsIDIwMDIsIDIwMDMsIDIwMDQKLlwiICAgICAgSW5mZXJubyBOZXR0dmVyayBB L1MsIE5vcndheS4gIEFsbCByaWdodHMgcmVzZXJ2ZWQuCi5cIgouXCIgUmVkaXN0 cmlidXRpb24gYW5kIHVzZSBpbiBzb3VyY2UgYW5kIGJpbmFyeSBmb3Jtcywgd2l0 aCBvciB3aXRob3V0Ci5cIiBtb2RpZmljYXRpb24sIGFyZSBwZXJtaXR0ZWQgcHJv dmlkZWQgdGhhdCB0aGUgZm9sbG93aW5nIGNvbmRpdGlvbnMKLlwiIGFyZSBtZXQ6 Ci5cIiAxLiBUaGUgYWJvdmUgY29weXJpZ2h0IG5vdGljZSwgdGhpcyBsaXN0IG9m IGNvbmRpdGlvbnMgYW5kIHRoZSBmb2xsb3dpbmcKLlwiICAgIGRpc2NsYWltZXIg bXVzdCBhcHBlYXIgaW4gYWxsIGNvcGllcyBvZiB0aGUgc29mdHdhcmUsIGRlcml2 YXRpdmUgd29ya3MKLlwiICAgIG9yIG1vZGlmaWVkIHZlcnNpb25zLCBhbmQgYW55 IHBvcnRpb25zIHRoZXJlb2YsIGFzd2VsbCBhcyBpbiBhbGwKLlwiICAgIHN1cHBv cnRpbmcgZG9jdW1lbnRhdGlvbi4KLlwiIDIuIEFsbCBhZHZlcnRpc2luZyBtYXRl cmlhbHMgbWVudGlvbmluZyBmZWF0dXJlcyBvciB1c2Ugb2YgdGhpcyBzb2Z0d2Fy ZQouXCIgICAgbXVzdCBkaXNwbGF5IHRoZSBmb2xsb3dpbmcgYWNrbm93bGVkZ2Vt ZW50OgouXCIgICAgICBUaGlzIHByb2R1Y3QgaW5jbHVkZXMgc29mdHdhcmUgZGV2 ZWxvcGVkIGJ5Ci5cIiAgICAgIEluZmVybm8gTmV0dHZlcmsgQS9TLCBOb3J3YXku Ci5cIiAzLiBUaGUgbmFtZSBvZiB0aGUgYXV0aG9yIG1heSBub3QgYmUgdXNlZCB0 byBlbmRvcnNlIG9yIHByb21vdGUgcHJvZHVjdHMKLlwiICAgIGRlcml2ZWQgZnJv bSB0aGlzIHNvZnR3YXJlIHdpdGhvdXQgc3BlY2lmaWMgcHJpb3Igd3JpdHRlbiBw ZXJtaXNzaW9uLgouXCIKLlwiIFRISVMgU09GVFdBUkUgSVMgUFJPVklERUQgQlkg VEhFIEFVVEhPUiBgYEFTIElTJycgQU5EIEFOWSBFWFBSRVNTIE9SCi5cIiBJTVBM SUVEIFdBUlJBTlRJRVMsIElOQ0xVRElORywgQlVUIE5PVCBMSU1JVEVEIFRPLCBU SEUgSU1QTElFRCBXQVJSQU5USUVTCi5cIiBPRiBNRVJDSEFOVEFCSUxJVFkgQU5E IEZJVE5FU1MgRk9SIEEgUEFSVElDVUxBUiBQVVJQT1NFIEFSRSBESVNDTEFJTUVE LgouXCIgSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUiBCRSBMSUFCTEUgRk9S IEFOWSBESVJFQ1QsIElORElSRUNULAouXCIgSU5DSURFTlRBTCwgU1BFQ0lBTCwg RVhFTVBMQVJZLCBPUiBDT05TRVFVRU5USUFMIERBTUFHRVMgKElOQ0xVRElORywg QlVUCi5cIiBOT1QgTElNSVRFRCBUTywgUFJPQ1VSRU1FTlQgT0YgU1VCU1RJVFVU RSBHT09EUyBPUiBTRVJWSUNFUzsgTE9TUyBPRiBVU0UsCi5cIiBEQVRBLCBPUiBQ Uk9GSVRTOyBPUiBCVVNJTkVTUyBJTlRFUlJVUFRJT04pIEhPV0VWRVIgQ0FVU0VE IEFORCBPTiBBTlkKLlwiIFRIRU9SWSBPRiBMSUFCSUxJVFksIFdIRVRIRVIgSU4g Q09OVFJBQ1QsIFNUUklDVCBMSUFCSUxJVFksIE9SIFRPUlQKLlwiIChJTkNMVURJ TkcgTkVHTElHRU5DRSBPUiBPVEhFUldJU0UpIEFSSVNJTkcgSU4gQU5ZIFdBWSBP VVQgT0YgVEhFIFVTRSBPRgouXCIgVEhJUyBTT0ZUV0FSRSwgRVZFTiBJRiBBRFZJ U0VEIE9GIFRIRSBQT1NTSUJJTElUWSBPRiBTVUNIIERBTUFHRS4KLlwiCi5cIiBJ bmZlcm5vIE5ldHR2ZXJrIEEvUyByZXF1ZXN0cyB1c2VycyBvZiB0aGlzIHNvZnR3 YXJlIHRvIHJldHVybiB0bwouXCIKLlwiICBTb2Z0d2FyZSBEaXN0cmlidXRpb24g Q29vcmRpbmF0b3IgIG9yICBzZGNAaW5ldC5ubwouXCIgIEluZmVybm8gTmV0dHZl cmsgQS9TCi5cIiAgT3NsbyBSZXNlYXJjaCBQYXJrCi5cIiAgR2F1c3RhZGFsbOll biAyMQouXCIgIE5PLTAzNDkgT3NsbwouXCIgIE5vcndheQouXCIKLlwiIGFueSBp bXByb3ZlbWVudHMgb3IgZXh0ZW5zaW9ucyB0aGF0IHRoZXkgbWFrZSBhbmQgZ3Jh bnQgSW5mZXJubyBOZXR0dmVyayBBL1MKLlwiIHRoZSByaWdodHMgdG8gcmVkaXN0 cmlidXRlIHRoZXNlIGNoYW5nZXMuCi5cIgouVEggU09DS0QuQ09ORiA1ICJNYXkg MTEsIDIwMDEiCi5TSCBOQU1FCnNvY2tkLmNvbmYgXC0gXGZCRGFudGVcZlAgc2Vy dmVyIGNvbmZpZ3VyYXRpb24gZmlsZSBzeW50YXgKLlNIIERFU0NSSVBUSU9OClRo ZSBjb25maWd1cmF0aW9uIGZpbGUgZm9yIHRoZSBcZkJEYW50ZVxmUCBzZXJ2ZXIg Y29udHJvbHMgYm90aCBhY2Nlc3MKY29udHJvbHMgYW5kIGxvZ2dpbmcuICBJdCBp cyBkaXZpZGVkIGludG8gdGhyZWUgcGFydHM7IHNlcnZlciBzZXR0aW5ncywKcnVs ZXMsIGFuZCByb3V0ZXMuICBBIGxpbmUgY2FuIGJlIGNvbW1lbnRlZCB1c2luZyB0 aGUgc3RhbmRhcmQgY29tbWVudApjaGFyYWN0ZXIgXGZCI1xmUC4KLlNIIFNFUlZF UiBTRVRUSU5HUwpUaGUgc2VydmVyIHNldHRpbmdzIGNvbnRyb2wgdGhlIGdlbmVy aWMgYmVoYXZpb3VyIG9mIHRoZSBzZXJ2ZXIuICBFYWNoCmtleXdvcmQgaXMgc2Vw YXJhdGVkIGZyb20gaXQncyB2YWx1ZSBieSBhIFxmQic6J1xmUCBjaGFyYWN0ZXIu Ci5cIiAuSVAgXGZCY2hpbGQubWF4aWRsZVxmUAouXCIgTWFpbnRhaW5zIGEgbWF4 aW11bSBvbiBob3cgbWFueSBjaGlsZHJlbiBvZiBlYWNoIHR5cGUgY2FuIHJlbWFp bgouXCIgaWRsZS4gIFVzZWQgdG8gcmVkdWNlIHRoZSBhbW91bnQgb2YgaWRsZSBw cm9jZXNzZXMgYWZ0ZXIgYSAiY2xpZW50IGJ1cnN0IgouXCIgaGFzIG9jY3VyZWQu ICBUaGUgZGVmYXVsdCBpcyBcZkIwXGZQIChubyBtYXhpbXVtKS4KLklQIFxmQmNv bXBhdGliaWxpdHlcZlAKV2l0aCB0aGUgXGZCc2FtZXBvcnRcZlAga2V5d29yZCwg dGhlIHNlcnZlciBhdHRlbXB0cyB0byB1c2UgdGhlIHNhbWUKcG9ydCBvbiB0aGUg c2VydmVyIGFuZCB0aGUgY2xpZW50LiAgVGhpcyBmdW5jdGlvbmFsaXR5IGlzIHRo ZSBkZWZhdWx0LCBidXQKd2hlbiB0aGlzIG9wdGlvbiBpcyBnaXZlbiBpdCB3aWxs IGFsc28gYmUgZG9uZSB3aXRoIHByaXZpbGVnZWQgcG9ydHMuClRoZSBcZkJyZXVz ZWFkZHJcZlAga2V5d29yZCBtaWdodCBzb2x2ZSBwcm9ibGVtcyB3aGVuIHRoZQpi aW5kIGV4dGVuc2lvbiBpcyB1c2VkIGJ1dCB0aGUgZWZmZWN0cyBvZiBlbmFibGlu ZyBcZkJyZXVzZWFkZHJcZlAKaXMgY3VycmVudGx5IHVua25vd24sIGRvIG5vdCBl bmFibGUgaXQgdW5sZXNzIHlvdSB1bmRlcnN0YW5kCnRoZSBlZmZlY3RzLgouSVAg XGZCY29ubmVjdHRpbWVvdXRcZlAKVGhlIG51bWJlciBvZiBzZWNvbmRzIGEgY2xp ZW50IGhhcyB0byBzZW5kIHRoZSByZXF1ZXN0IGFmdGVyIGEgY29ubmVjdC4KU2V0 IGl0IHRvIDAgZm9yIGZvcmV2ZXIuCi5JUCBcZkJleHRlcm5hbFxmUApUaGUgYWRk cmVzcyB0byBiZSB1c2VkIGZvciBvdXRnb2luZyBjb25uZWN0aW9ucy4KVGhlIGFk ZHJlc3MgZ2l2ZW4gbWF5IGJlIGVpdGhlciBhIElQIGFkZHJlc3Mgb3IgYSBpbnRl cmZhY2VuYW1lLgpDYW4gYmUgZ2l2ZW4gbXVsdGlwbGUgdGltZXMgZm9yIGRpZmZl cmVudCBhZGRyZXNzZXMuCi5JUCBcZkJleHRlcm5hbC5yb3RhdGlvblxmUApJZiBt b3JlIHRoYW4gb25lIGV4dGVybmFsIGFkZHJlc3MgaXMgZ2l2ZW4sIHRoaXMgZ292 ZXJucyB3aGljaAphZGRyZXNzIGlzIHNlbGVjdGVkLiAgVmFsaWQgdmFsdWVzIGFy ZSBcZkJub25lXGZQICh0aGUgZGVmYXVsdCkgYW5kClxmQnJvdXRlXGZQLiAgVGhl IGxhdHRlciBtaWdodCByZXF1aXJlIHlvdSB0byBzZXQgXGZCdXNlci5wcml2aWxl Z2VkXGZQIHRvClxmQnJvb3RcZlAuCgpOb3RlIHRoYXQgXGZCcm91dGVcZlAgbWln aHQgY3JlYXRlIHByb2JsZW1zIGZvcgpmdHAtY2xpZW50cyB1c2luZyBhY3RpdmUg ZnRwIGlmIHRoZSBcZkJEYW50ZVxmUCBiaW5kIGV4dGVuc2lvbgppcyBlbmFibGVk IGZvciB0aGUgZnRwLWNsaWVudC4KLklQIFxmQmludGVybmFsXGZQClRoZSBpbnRl cm5hbCBhZGRyZXNzZXMuICBDb25uZWN0aW9ucyB3aWxsIG9ubHkgYmUgYWNjZXB0 ZWQgb24gdGhlc2UgYWRkcmVzc2VzLgpUaGUgYWRkcmVzcyBnaXZlbiBtYXkgYmUg ZWl0aGVyIGEgSVAgYWRkcmVzcyBvciBhIGludGVyZmFjZW5hbWUuCi5JUCBcZkJp b3RpbWVvdXRcZlAKVGhlIG51bWJlciBvZiBzZWNvbmRzIGFuIGVzdGFibGlzaGVk IGNvbm5lY3Rpb24gY2FuIGJlIGlkbGUuICBTZXQgaXQKdG8gMCBmb3IgZm9yZXZl ci4KLklQIFxmQmxvZ291dHB1dFxmUApUaGlzIHZhbHVlIGNvbnRyb2xzIHdoZXJl IHRoZSBzZXJ2ZXIgc2VuZHMgbG9nb3V0cHV0LiAgSXQgY2FuCmJlIGVpdGhlciBc ZkJzeXNsb2dcZlBbL1xmQmZhY2lsaXR5XGZQXSwgXGZCc3Rkb3V0XGZQLCBcZkJz dGRlcnJcZlAsCmEgZmlsZW5hbWUsIG9yIGEgY29tYmluYXRpb24uCi5JUCBcZkJt ZXRob2RcZlAKQSBsaXN0IG9mIGFjY2VwdGFibGUgYXV0aGVudGljYXRpb24gbWV0 aG9kcyBmb3Igc29ja3MtcnVsZXMsIGluIG9yZGVyCm9mIHByZWZlcmVuY2UuClN1 cHBvcnRlZCB2YWx1ZXMgYXJlIFxmQnVzZXJuYW1lXGZQLCBcZkJub25lXGZQLCBc ZkJyZmM5MzFcZlAgYW5kIFxmQnBhbVxmUC4KVGhpcyBsaXN0IGlzIHVzZWQgYXMg dGhlIGRlZmF1bHQgZm9yIGFsbCBjb21pbmcgcnVsZXMgdW50aWwKY2hhbmdlZC4g IFRoZW4gdGhlIGNoYW5nZWQgbGlzdCBpcyB1c2VkIGFzIHRoZSBkZWZhdWx0IGZv cgp0aGUgbmV4dCBydWxlcy4KCklmIGEgbWV0aG9kIGlzIG5vdCBzZXQgaW4gdGhp cyBsaXN0IGl0IHdpbGwgbmV2ZXIgYmUgc2VsZWN0ZWQuCgpTZWUgdGhlIHNlY3Rp b24gb24gbWV0aG9kcyBmb3IgYSBleHBsYW5hdGlvbiBvZiB0aGUgZGlmZmVyZW50 IG1ldGhvZHMuCgouSVAgXGZCY2xpZW50bWV0aG9kXGZQCkEgbGlzdCBvZiBhY2Nl cHRhYmxlIGF1dGhlbnRpY2F0aW9uIG1ldGhvZHMgZm9yIGNsaWVudC1ydWxlcywK aW4gb3JkZXIgb2YgcHJlZmVyZW5jZS4gIFRoZXNlIGFyZSB0aGUgYXV0aGVudGlj YXRpb25tZXRob2RzCnRoYXQgY2FuIHByb3ZpZGUgYXV0aGVudGljYXRpb25zIGJh c2VkIG9uIGp1c3QgdGhlIGNsaWVudCdzClRDUCBjb25uZWN0aW9uLgpTdXBwb3J0 ZWQgdmFsdWVzIGFyZSBcZkJub25lXGZQLCBcZkJyZmM5MzFcZlAgYW5kIFxmQnBh bVxmUC4KVGhpcyBsaXN0IGlzIHVzZWQgYXMgdGhlIGRlZmF1bHQgZm9yIGFsbCBj b21pbmcgcnVsZXMgdW50aWwKY2hhbmdlZC4gIFRoZW4gdGhlIGNoYW5nZWQgbGlz dCBpcyB1c2VkIGFzIHRoZSBkZWZhdWx0IGZvcgp0aGUgbmV4dCBydWxlcy4gIFRo ZSBkZWZhdWx0IHZhbHVlIGlzIFxmQm5vbmVcZlAuCgpJZiBhIG1ldGhvZCBpcyBu b3Qgc2V0IGluIHRoaXMgbGlzdCBpdCB3aWxsIG5ldmVyIGJlIHNlbGVjdGVkLgoK LklQIFxmQnNyY2hvc3RcZlAKV2l0aCB0aGUgXGZCbm9taXNtYXRjaFxmUCBrZXl3 b3JkLCB0aGUgc2VydmVyIHdpbGwgbm90IGFjY2VwdApjb25uZWN0cyBmcm9tIGFk ZHJlc3NlcyBoYXZpbmcgYSBtaXNtYXRjaCBiZXR3ZWVuIEROUyBhZGRyZXNzIGFu ZCBob3N0bmFtZS4KRGVmYXVsdCBpcyB0byBhY2NlcHQgdGhlbS4KV2l0aCB0aGUg XGZCbm91bmtub3duXGZQIGtleXdvcmQsIHRoZSBzZXJ2ZXIgd2lsbCBub3QgYWNj ZXB0IGNvbm5lY3RzCmZyb20gYWRkcmVzc2VzIHdpdGhvdXQgYSBETlMgcmVjb3Jk LiAgRGVmYXVsdCBpcyB0byBhY2NlcHQgdGhlbS4KCi5JUCBcZkJ1c2VyLnByaXZp bGVnZWRcZlAKVXNlcm5hbWUgd2hpY2ggd2lsbCBiZSB1c2VkIGZvciBkb2luZyBw cml2aWxlZ2VkIG9wZXJhdGlvbnMuCi5JUCBcZkJ1c2VyLm5vdHByaXZpbGVnZWRc ZlAKVXNlciB3aGljaCB0aGUgc2VydmVyIHJ1bnMgYXMgbW9zdCBvZiB0aGUgdGlt ZS4KLklQIFxmQnVzZXIubGlid3JhcFxmUApVc2VyIHVzZWQgdG8gZXhlY3V0ZSBs aWJ3cmFwIGNvbW1hbmRzLgoKLlNIIE1PRFVMRVMKVGhlIGZvbGxvd2luZyBtb2R1 bGVzIGFyZSBzdXBwb3J0ZWQgYnkgXGZCRGFudGVcZlAuICBNb2R1bGVzIGFyZSBw dXJjaGFzZWQKc2VwYXJhdGVseSBmcm9tIEluZmVybm8gTmV0dHZlcmsgQS9TLiAg U2VlIHRoZSBcZkJEYW50ZVxmUCBob21lcGFnZQpmb3IgbW9yZSBpbmZvcm1hdGlv bi4KCi5JUCBcZkJiYW5kd2lkdGhcZlAKVGhlIFxmQmJhbmR3aWR0aFxmUCBtb2R1 bGUgZ2l2ZXMgeW91IGNvbnRyb2wgb3ZlciBob3cgbXVjaApiYW5kd2lkdGggdGhl IERhbnRlIHNlcnZlciB1c2VzIG9uIGJlaGFsZiBvZiBkaWZmZXJlbnQgY2xpZW50 cy4KCi5JUCBcZkJyZWRpcmVjdFxmUApUaGUgXGZCcmVkaXJlY3RcZlAgbW9kdWxl IGdpdmVzIHlvdSBjb250cm9sIG92ZXIgd2hhdCBhZGRyZXNzZXMgdGhlCnNlcnZl ciB3aWxsIHVzZSBvbiBiZWhhbGYgb2YgdGhlIGNsaWVudCBhbmQgYWxsb3dzIHlv dSB0byBib3RoCnJlZGlyZWN0IGNsaWVudCByZXF1ZXN0cyB0byBhIGRpZmZlcmVu dCBhZGRyZXNzZXMgYXN3ZWxsIGFzIGNvbnRyb2wKdGhlIHJhbmdlIG9mIGFkZHJl c3NlcyBhbmQgcG9ydHMgdG8gYmUgdXNlZCBvbiBiZWhhbGYgb2YgdGhlIGNsaWVu dC4KCi5JUCBcZkJzZXNzaW9uXGZQClRoZSBcZkJzZXNzaW9uXGZQIG1vZHVsZSBn aXZlcyB5b3UgY29udHJvbCBvdmVyIHRoZSBudW1iZXIgb2YKc2Vzc2lvbnMgdGhh dCBjYW4gYmUgY3JlYXRlZCBieSBkaWZmZXJlbnQgc29ja3MgdXNlcnMuCgoKLlNI IE1FVEhPRFMKVGhlIFxmQkRhbnRlXGZQIHNlcnZlciBzdXBwb3J0cyB0aGUgZm9s bG93aW5nIG1ldGhvZHMuICBTb21lCmluc3RhbGxhdGlvbnMgb2YgXGZCRGFudGVc ZlAgbWF5IHN1cHBvcnQgb25seSBhIHN1YnNldCBvZiB0aGVzZS4KCi5JUCBcZkJu b25lXGZQClRoZSBtZXRob2QgcmVxdWlyZXMgbm8gZm9ybSBvZiBhdXRoZW50aWNh dGlvbi4KLklQIFxmQnVzZXJuYW1lXGZQClRoZSBtZXRob2QgcmVxdWlyZXMgdGhl IGNsaWVudCB0byBwcm92aWRlIGEgdXNlcm5hbWUgYW5kIHBhc3N3b3JkLgpUaGlz IG11c3QgbWF0Y2ggdGhlIHVzZXJuYW1lIGFuZCBwYXNzd29yZCBnaXZlbiBpbiB0 aGUgc3lzdGVtCnBhc3N3b3JkZmlsZS4KLklQIFxmQnJmYzkzMVxmUApUaGUgbWV0 aG9kIHJlcXVpcmVzIHRoZSBjbGllbnQgaG9zdCB0byBwcm92aWRlIGEgcmZjOTMx ICgiaWRlbnQiKQpyZXBseSBmb3IgdGhlIGNvbm5lY3RpbmcgY2xpZW50LiAgVGhl IG5hbWUgZ2l2ZW4gaW4gdGhlIHJlcGx5Cm11c3QgYmUgcHJlc2VudCBpbiB0aGUg cGFzc3dvcmQgZGF0YWJhc2UuCi5JUCBcZkJwYW1cZlAKVGhlIG1ldGhvZCByZXF1 aXJlcyB0aGUgYXZhaWxhYmxlIGNsaWVudGRhdGEgdG8gbWF0Y2ggYWdhaW5zdCB0 aGUKcGFtIGRhdGFiYXNlLgoKCi5TSCBBRERSRVNTRVMKRWFjaCBhZGRyZXNzIGZp ZWxkIGNhbiBjb25zaXN0IG9mIGEgSVAgYWRkcmVzcyAoYW5kIHdoZXJlIG1lYW5p bmdmdWwsCmEgbmV0bWFzaywgc2VwYXJhdGVkIGZyb20gdGhlIElQIGFkZHJlc3Mg YnkgYSAnXGZCL1xmUCcgc2lnbi4pLCBhIGhvc3RuYW1lLApvciBhIGRvbWFpbm5h bWUgKGRlc2lnbmF0ZWQgc28gYnkgdGhlIGxlYWRpbmcgJ1xmQi5cZlAnKS4KRWFj aCBhZGRyZXNzIGNhbiBiZSBmb2xsb3dlZCBieSBhIG9wdGlvbmFsIFxmQnBvcnRc ZlAgc3BlY2lmaWVyLgouU0ggUlVMRVMKVGhlcmUgYXJlIHR3byBzZXRzIG9mIHJ1 bGVzIGFuZCB0aGV5IHdvcmsgYXQgZGlmZmVyZW50IGxldmVscy4KUnVsZXMgcHJl Zml4ZWQgd2l0aCBcZkJjbGllbnRcZlAgYXJlIGNoZWNrZWQgZmlyc3QgYW5kIGFy ZSB1c2VkIHRvCnNlZSBpZiB0aGUgY2xpZW50IGlzIGFsbG93ZWQgdG8gY29ubmVj dCB0byB0aGUgXGZCRGFudGVcZlAgc2VydmVyLgpXZSB3aWxsIGNhbGwgdGhlbSAi Y2xpZW50LXJ1bGVzIi4KSXQgaXMgZXNwZWNpYWxseSBpbXBvcnRhbnQgdGhhdCB0 aGVzZSBkbyBub3QgdXNlIGhvc3RuYW1lcwpidXQgb25seSBJUCBhZGRyZXNzZXMs IGJvdGggZm9yIHNlY3VyaXR5IGFuZCBwZXJmb3JtYW5jZSByZWFzb25zLgpUaGVz ZSBydWxlcyB3b3JrIGF0IHRoZSBUQ1AvSVAgbGV2ZWwuCgpUaGUgb3RoZXIgcnVs ZXMsIHdoaWNoIHdlIHdpbGwgY2FsbCAic29ja3MtcnVsZXMiIGFyZSBhIGxldmVs IGhpZ2hlcgphbmQgYXJlIGNoZWNrZWQgYWZ0ZXIgdGhlIGNsaWVudCBjb25uZWN0 aW9uIGhhcyBiZWVuIGFjY2VwdGVkIGJ5IHRoZQpjbGllbnQtcnVsZXMuICBUaGUg c29ja3MtcnVsZXMgYXJlIHVzZWQgdG8gZXZhbHVhdGUgdGhlIHNvY2tzIHJlcXVl c3QKdGhhdCB0aGUgY2xpZW50IHNlbmRzLiAgVGhleSB0aHVzIHdvcmsgYXQgdGhl IHNvY2tzIHByb3RvY29sIGxldmVsLgoKQm90aCBzZXQgb2YgcnVsZXMgc3RhcnQg d2l0aCBhIFxmQnBhc3NcZlAvXGZCZGVueVxmUCBrZXl3b3JkICh0aGUKY2xpZW50 LXJ1bGVzIGhhdmUgImNsaWVudCIgcHJlZml4ZWQgdG8gdGhlIFxmQnBhc3NcZlAv XGZCZGVueVxmUAprZXl3b3JkKSB3aGljaCBkZXRlcm1pbmVzIGlmIGNvbm5lY3Rp b25zIG1hdGNoaW5nIHRoZSBydWxlIGFyZSB0bwpwYXNzIG9yIGJlIGJsb2NrZWQu ICBCb3RoIHNldCBvZiBydWxlcyBhbHNvIHNwZWNpZnkgYSBcZkJmcm9tXGZQL1xm QnRvXGZQCmFkZHJlc3MgcGFpciB3aGljaCBnaXZlcyB0aGUgYWRkcmVzc2VzIHRo ZSBydWxlIHdpbGwgbWF0Y2guCgpJbiBib3RoIGNvbnRleHRzLCBcZkJmcm9tXGZQ IG1lYW5zIHRoZSBjbGllbnRzIGFkZHJlc3MuCgpJbiB0aGUgY2xpZW50LXJ1bGUg Y29udGV4dCwgXGZCdG9cZlAgbWVhbnMgdGhlIGFkZHJlc3MgdGhlIHJlcXVlc3QK aXMgYWNjZXB0ZWQgb24sIGkuZS4gdGhlIGFkZHJlc3MgdGhlIFxmQkRhbnRlXGZQ IHNlcnZlciBsaXN0ZW5zCm9uLgoKSW4gdGhlIHNvY2tzLXJ1bGUgY29udGV4dCwg XGZCdG9cZlAgbWVhbnMgdGhlIGNsaWVudCdzIGRlc3RpbmF0aW9uIGFkZHJlc3Ms CmFzIGZvcm11bGF0ZWQgaW4gdGhlIGNsaWVudCdzIHByb3h5IHJlcXVlc3QuCgpJ biBhZGRpdGlvbiB0byB0aGUgYWRkcmVzc2VzIHRoZXJlIGlzIGEgc2V0IG9mIG9w dGlvbmFsIGtleXdvcmRzIHdoaWNoCmNhbiBiZSBnaXZlbi4gIFRoZXJlIGFyZSB0 d28gZm9ybXMgb2Yga2V5d29yZHMsIGNvbmRpdGlvbnMgYW5kCmFjdGlvbnMuICBG b3IgZWFjaCBydWxlLCBhbGwgY29uZGl0aW9ucyBhcmUgY2hlY2tlZCBhbmQgaWYg dGhleQptYXRjaCB0aGUgcmVxdWVzdCwgdGhlIGFjdGlvbnMgYXJlIGV4ZWN1dGVk LgoKVGhlIGxpc3Qgb2YgY29uZGl0aW9uIGtleXdvcmRzIGlzOgpcZkJmcm9tXGZQ LCBcZkJ0b1xmUCwgXGZCY29tbWFuZFxmUCwgXGZCbWV0aG9kXGZQLApcZkJwcm90 b2NvbFxmUCwgXGZCcHJveHlwcm90b2NvbFxmUCwgXGZCdXNlclxmUC4KClRoZSBs aXN0IG9mIGFjdGlvbnMga2V5d29yZHMgaXM6IFxmQmJhbmR3aWR0aFxmUCwgXGZC bGlid3JhcFxmUCwKXGZCbG9nXGZQIGFuZCBcZkJyZWRpcmVjdFxmUC4KClRoZSBm b3JtYXQgYW5kIGNvbnRlbnQgb2YgdGhlIHJ1bGVzIGlzIGlkZW50aWNhbCwgYnV0 IGNsaWVudC1ydWxlcwptYXkgY29udGFpbiBvbmx5IGEgc3Vic2V0IG9mIHRoZSBz b2Nrcy1ydWxlcy4gIE1vcmUgY29uY3JldGUsIHRoZXkKbWF5IG5vdCBjb250YWlu IGFueSBrZXl3b3JkcyByZWxhdGVkIHRvIHRoZSBzb2NrcyBwcm90b2NvbC4KCi5J UApUaGUgY29udGVudHMgb2YgYSBjbGllbnQtcnVsZSBpczoKCi5JUCBcZkJmcm9t XGZQClRoZSBydWxlIGFwcGxpZXMgdG8gcmVxdWVzdHMgY29taW5nIGZyb20gdGhl IGFkZHJlc3MgZ2l2ZW4gYXMgdmFsdWUuCi5JUCBcZkJ0b1xmUApUaGUgcnVsZSBh cHBsaWVzIHRvIHJlcXVlc3RzIGdvaW5nIHRvIHRoZSBhZGRyZXNzIGdpdmVuIGFz IHZhbHVlLgouSVAgXGZCcG9ydFxmUApQYXJhbWV0ZXIgdG8gXGZCZnJvbVxmUCwg XGZCdG9cZlAgYW5kIFxmQnZpYVxmUC4gIEFjY2VwdHMgdGhlIGtleXdvcmRzClxm QmVxLz0sIG5lcS8hPSwgZ2UvPj0sIGxlLzw9LCBndC8+LCBsdC88XGZQIGZvbGxv d2VkIGJ5IGEgbnVtYmVyLgpBIHBvcnRyYW5nZSBjYW4gYWxzbyBiZSBnaXZlbiBh cyAicG9ydCA8c3RhcnQgIz4gLSA8ZW5kICM+Iiwgd2hpY2gKd2lsbCBtYXRjaCBh bGwgcG9ydCBudW1iZXJzIHdpdGhpbiB0aGUgcmFuZ2UgPHN0YXJ0ICM+IGFuZCA8 ZW5kICM+LgouSVAgXGZCbGlid3JhcFxmUApUaGUgc2VydmVyIHdpbGwgcGFzcyB0 aGUgbGluZSB0byBsaWJ3cmFwIGZvciBleGVjdXRpb24uCi5JUCBcZkJsb2dcZlAK VXNlZCB0byBjb250cm9sIGxvZ2dpbmcuICBBY2NlcHRlZCBrZXl3b3JkcyBhcmUg XGZCY29ubmVjdFxmUCwKXGZCZGlzY29ubmVjdFxmUCwgXGZCZGF0YVxmUCwgXGZC ZXJyb3JcZlAgYW5kIFxmQmlvb3BlcmF0aW9uXGZQLgouSVAgXGZCdXNlclxmUApU aGUgc2VydmVyIHdpbGwgb25seSBhY2NlcHQgY29ubmVjdGlvbnMgZnJvbSB1c2Vy cyBtYXRjaGluZyBvbmUKb2YgdGhlIG5hbWVzIGdpdmVuIGFzIHZhbHVlLgpJZiBu byBcZkJ1c2VyXGZQIHZhbHVlIGlzIGdpdmVuLCBldmVyeW9uZSBpbiB0aGUgcGFz c3dvcmRmaWxlCndpbGwgYmUgbWF0Y2hlZC4KVGhlIHJ1bGUgbXVzdCBhbHNvIGFs bG93IHVzZXJuYW1lYmFzZWQgbWV0aG9kcy4KLklQIFxmQm1ldGhvZFxmUApSZXF1 aXJlIHRoYXQgdGhlIGNvbm5lY3Rpb24gYmUgImF1dGhlbnRpY2F0ZWQiIHVzaW5n IG9uZSBvZiB0aGUKZ2l2ZW4gbWV0aG9kcy4KLklQIFxmQnBhbS5zZXJ2aWNlbmFt ZVxmUApXaGljaCBzZXJ2aWNlbmFtZSB0byB1c2Ugd2hlbiBpbnZvbHZpbmcgcGFt LiAgRGVmYXVsdCBpcyAic29ja2QiLgoKLklQClRoZSBjb250ZW50cyBvZiBhIHNv Y2tzLXJ1bGUgaXM6CgouSVAgXGZCZnJvbVxmUApUaGUgcnVsZSBhcHBsaWVzIHRv IHJlcXVlc3RzIGNvbWluZyBmcm9tIHRoZSBhZGRyZXNzIGdpdmVuIGFzIHZhbHVl LgouSVAgXGZCdG9cZlAKVGhlIHJ1bGUgYXBwbGllcyB0byByZXF1ZXN0cyBnb2lu ZyB0byBvciB1c2luZyB0aGUgYWRkcmVzcyBnaXZlbiBhcyB2YWx1ZS4KTm90ZSB0 aGF0IHRoZSBtZWFuaW5nIG9mIHRoaXMgYWRkcmVzcyBpcyBhZmZlY3RlZCBieSBc ZkJjb21tYW5kXGZQLgouSVAgXGZCcG9ydFxmUApQYXJhbWV0ZXIgdG8gXGZCZnJv bVxmUCwgXGZCdG9cZlAgYW5kIFxmQnZpYVxmUC4gIEFjY2VwdHMgdGhlIGtleXdv cmRzClxmQmVxLz0sIG5lcS8hPSwgZ2UvPj0sIGxlLzw9LCBndC8+LCBsdC88XGZQ IGZvbGxvd2VkIGJ5IGEgbnVtYmVyLgpBIHBvcnRyYW5nZSBjYW4gYWxzbyBiZSBn aXZlbiBhcyAicG9ydCA8c3RhcnQgIz4gLSA8ZW5kICM+Iiwgd2hpY2gKd2lsbCBt YXRjaCBhbGwgcG9ydCBudW1iZXJzIHdpdGhpbiB0aGUgcmFuZ2UgPHN0YXJ0ICM+ IGFuZCA8ZW5kICM+LgoKLklQIFxmQmJhbmR3aWR0aFxmUApUaGUgY2xpZW50cyBt YXRjaGluZyB0aGlzIHJ1bGUgd2lsbCBhbGwgc2hhcmUgdGhpcyBhbW91bnQgb2Yg YmFuZHdpZHRoLgouSVAgXGZCY29tbWFuZFxmUApUaGUgcnVsZSBhcHBsaWVzIHRv IHRoZSBnaXZlbiBjb21tYW5kcy4gIFZhbGlkIGNvbW1hbmRzCmFyZSBcZkJiaW5k XGZQLCBcZkJiaW5kcmVwbHlcZlAsIFxmQmNvbm5lY3RcZlAsIFxmQnVkcGFzc29j aWF0ZVxmUAphbmQgXGZCdWRwcmVwbHlcZlAuICBDYW4gYmUgdXNlZCBpbnN0ZWFk IG9mLCBvciB0byBjb21wbGVtZW50LApcZkJwcm90b2NvbFxmUC4KLklQIFxmQmxp YndyYXBcZlAKVGhlIHNlcnZlciB3aWxsIHBhc3MgdGhlIGxpbmUgdG8gbGlid3Jh cCBmb3IgZXhlY3V0aW9uLgouSVAgXGZCbG9nXGZQClVzZWQgdG8gY29udHJvbCBs b2dnaW5nLiAgQWNjZXB0ZWQga2V5d29yZHMgYXJlIFxmQmNvbm5lY3RcZlAsClxm QmRpc2Nvbm5lY3RcZlAsIFxmQmRhdGFcZlAgYW5kIFxmQmlvb3BlcmF0aW9uXGZQ LgouSVAgXGZCbWV0aG9kXGZQClJlcXVpcmUgdGhhdCB0aGUgY29ubmVjdGlvbiBi ZSBlc3RhYmxpc2hlZCB1c2luZyBvbmUgb2YgdGhlCmdpdmVuIG1ldGhvZHMuICBc ZkJtZXRob2RcZlAgYWx3YXlzIHJlZmVycyB0byB0aGUgc291cmNlIHBhcnQgb2YK dGhlIHJ1bGUuClZhbGlkIHZhbHVlcyBhcmUgdGhlIHNhbWUgYXMgaW4gdGhlIGds b2JhbCBcZkJtZXRob2RcZlAgbGluZS4KLklQIFxmQnBhbS5zZXJ2aWNlbmFtZVxm UApXaGF0IHNlcnZpY2VuYW1lIHRvIHVzZSB3aGVuIGludm9sdmluZyBwYW0uICBE ZWZhdWx0IGlzICJzb2NrZCIuCi5JUCBcZkJwcm90b2NvbFxmUApUaGUgcnVsZSBh cHBsaWVzIHRvIHRoZSBnaXZlbiBwcm90b2NvbHMuICBWYWxpZCB2YWx1ZXMgYXJl ClxmQnRjcFxmUCBhbmQgXGZCdWRwXGZQLiAgSXQgaXMgcmVjb21tZW5kZWQgdGhh dCB0aGUgXGZCY29tbWFuZFxmUApmb3JtIGlzIHVzZWQgc2luY2UgaXQgcHJvdmlk ZXMgbW9yZSBhY2N1cmFjeSBpbiBkZWZpbmluZyBydWxlcy4KLklQIFxmQnByb3h5 cHJvdG9jb2xcZlAKVGhlIHJ1bGUgYXBwbGllcyB0byByZXF1ZXN0cyB1c2luZyB0 aGUgZ2l2ZW4gcHJveHlwcm90b2NvbC4KVmFsaWQgcHJveHlwcm90b2NvbHMgYXJl IFxmQnNvY2tzX3Y0XGZQIGFuZCBcZkJzb2Nrc192NVxmUC4KLklQIFxmQnJlZGly ZWN0XGZQClRoZSBzb3VyY2UgYW5kL29yIGRlc3RpbmF0aW9uIGNhbiBiZSByZWRp cmVjdGVkIHVzaW5nIHRoZQpcZkJyZWRpcmVjdFxmUCBzdGF0ZW1lbnQuICBUaGUg c3ludGF4IG9mIHRoZSBzdGF0ZW1lbnQgaXMKYXMgZm9sbG93czoKCi5EMQpcZkJy ZWRpcmVjdFxmUCBmcm9tOiBcZkJBRERSRVNTXGZQCgouRDEKXGZCcmVkaXJlY3Rc ZlAgdG86IFxmQkFERFJFU1NcZlAKClRoZSBzZW1hbnRpY3Mgb2YgXGZCZnJvbVxm UCBhbmQgXGZCdG9cZlAgdmFyeSBhY2NvcmRpbmcgdG8KXGZCY29tbWFuZFxmUCBh bmQgc2hvdWxkIGJlIGludHVpdGl2ZSBlbm91Z2guCgouSVAgXGZCdXNlclxmUApU aGUgc2VydmVyIHdpbGwgYWNjZXB0IGNvbm5lY3Rpb25zIGZyb20gdXNlcnMgbWF0 Y2hpbmcgb25lCm9mIHRoZSBuYW1lcyBnaXZlbiBhcyB2YWx1ZS4KSWYgbm8gXGZC dXNlclxmUCB2YWx1ZSBpcyBnaXZlbiwgZXZlcnlvbmUgaW4gdGhlIHBhc3N3b3Jk ZmlsZQp3aWxsIGJlIG1hdGNoZWQuClRoZSBydWxlIG11c3QgaW4gdGhpcyBjYXNl IGFsc28gYWxsb3cgdXNlcm5hbWViYXNlZCBtZXRob2RzLgouU0ggUk9VVEVTClRo ZSByb3V0ZXMgYXJlIHNwZWNpZmllZCB3aXRoIGEgXGZCcm91dGVcZlAga2V5d29y ZC4KSW5zaWRlIGEgcGFpciBvZiBwYXJlbnMgKHt9KSBhIHNldCBvZiBrZXl3b3Jk cyBjb250cm9sIHRoZSBiZWhhdmlvciBvZgp0aGUgcm91dGUuICBTZWUgc29ja3Mu Y29uZig1KSBmb3IgYSBkZXNjcmlwdGlvbi4gIFRoaXMgaXMgdXNlZCB0bwpwZXJm b3JtIHNvLWNhbGxlZCAic2VydmVyLWNoYWluaW5nIiwgd2hlcmUgb25lIHNvY2tz LXNlcnZlciBjb25uZWN0cwp0byBhbm90aGVyIHNvY2tzLXNlcnZlciBmdXRoZXIg dXBzdHJlYW0uICAKLlNIIEVYQU1QTEVTClNlZSB0aGUgZXhhbXBsZSBkaXJlY3Rv cnkgaW4gdGhlIGRpc3RyaWJ1dGlvbi4KLlNIIEZJTEVTCi5uZgovZXRjL3NvY2tk LmNvbmYJXGZCRGFudGVcZlAgc2VydmVyIGNvbmZpZ3VyYXRpb24gZmlsZS4KL2V0 Yy9wYXNzd2QJZmlsZSB1c2VkIHdoZW4gY2hlY2tpbmcgdXNlcm5hbWUvcGFzc3dv cmRzLgouZmkKLlNIIEFVVEhPUlMKRm9yIEluZmVybm8gTmV0dHZlcmsgQS9TLCBO b3J3YXk6CiBNaWNoYWVsIFNodWxkbWFuIDxtaWNoYWVsc0BpbmV0Lm5vPjogRGVz aWduIGFuZCBpbXBsZW1lbnRhdGlvbi4KIEthcmwtQW5kcmUnIFNrZXZpayA8a2Fy bHNAaW5ldC5ubz46IEF1dG9jb25mIGFuZCBwb3J0aW5nLgouU0ggU0VFIEFMU08K c29ja2QoMW0pLCBzb2Nrcy5jb25mKDQpLCBzb2Nrc2lmeSgxKSwgaG9zdHNfYWNj ZXNzKDUpCi5QcApJbmZvcm1hdGlvbiBhYm91dCBuZXcgcmVsZWFzZXMgYW5kIG90 aGVyIHJlbGF0ZWQgaXNzdWVzIGNhbiBiZSBmb3VuZApvbiB0aGUKLk5tIFxmQkRh bnRlXGZQCldXVyBob21lIHBhZ2UgYXQgaHR0cDovL3d3dy5pbmV0Lm5vL2RhbnRl LgphbGlkIHZhbHVlcyBhcmUgXGZCbm9uZVxmUCAodGhlIGRlZmF1bHQpIGFuZApc ZkJyb3V0ZVxmUC4gIFRoZSBsYXR0ZXIgbWlnaHQgcmVxdWlyZSB5b3UgdG8gc2V0 IFxmQnVzZXIucHJpdmlsZWdlZFxmUCB0bwpcZkJyb290XGZQLgoKTm90ZSB0aGF0 IFxmQnJvdXRlXGZQIG1pZ2h0IGNyZWF0ZSBwcm9ibGVtcyBmb3IKZnRwLWNsaWVu dHMgdXNpbmcgYWN0aXZlIGZ0cCBpZiB0aGUgXGZCRGFudGVcZlAgYmluZCBleHRl bnNpb24KaXMgZW5hYmxlZCBmb3IgdGhlIGZ0cC1jbGllbnQuCi5JUCBcZkJpbnRl cm5hbFxmUApUaGUgaW50ZXJuYWwgYWRkcmVzc2VzLiAgQ29ubmVjdGlvbnMgd2ls bCBvbmx5IGJlIGFjY2VwdGVkIG9uIHRoZXNlIGFkZHJlc3Nlcy4KVGhlIGFkZHJl c3MgZ2l2ZW4gbWF5IGJlIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= --Boundary_(ID_neg25AIe/riohtgjnHdu6g) Content-type: application/x-tar; name=psarc-material.tar Content-transfer-encoding: BASE64 Content-disposition: inline; filename=psarc-material.tar bWF0ZXJpYWwvZGFudGUtcHJvcG9zYWxfdjQudHh0AAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAADAwMDA3MTEAMDQwNzE1NgAwMDAwMDEyADAwMDAwMDMwMjY0ADExMTE1NDQ1 MjUzADAwMTcyNjYAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAB1c3RhcgAwMG1uMTMzNzY2AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAc3RhZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwMTQ2 ADAwMDAwMDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxLjAgUHJvamVjdCBJbmZv cm1hdGlvbgoxLjEgTmFtZSBvZiBwcm9qZWN0L2NvbXBvbmVudAoJRGFudGU6IEEg U29ja3Mgc2VydmVyIGFuZCBjbGllbnQgaW1wbGVtZW50YXRpb24KCjEuMiBBdXRo b3Igb2YgZG9jdW1lbnQKCU1heXVyZXNoIE5pcmhhbGkKCjIuMCBQcm9qZWN0IFN1 bW1hcnkKICAyLjEgUHJvamVjdCBEZXNjcmlwdGlvbgoKICAgICAgICBEYW50ZSBp cyBhIGNpcmN1aXQtbGV2ZWwgZmlyZXdhbGwvcHJveHkgdGhhdCBjYW4gYmUgdXNl ZCB0byBwcm92aWRlCiAgICAgICAgY29udmVuaWVudCBhbmQgc2VjdXJlIG5ldHdv cmsgY29ubmVjdGl2aXR5IHRvIGEgd2lkZSByYW5nZSBvZiBob3N0cwogICAgICAg IHdoaWxlIHJlcXVpcmluZyBvbmx5IHRoZSBzZXJ2ZXIgRGFudGUgcnVucyBvbiB0 byBoYXZlIGV4dGVybmFsCiAgICAgICAgbmV0d29yayBjb25uZWN0aXZpdHkuCiAg CiAgMi4yIFJlbGVhc2UgYmluZGluZwogICAgICBXaGF0IGlzIGlzIHRoZSByZWxl YXNlIGJpbmRpbmc/CiAgICAgIChzZWUgaHR0cDovL29wZW5zb2xhcmlzLm9yZy9v cy9jb21tdW5pdHkvYXJjL3BvbGljaWVzL3JlbGVhc2UtdGF4b25vbXkvKQogICAg ICBbIF0gTWFqb3IKICAgICAgW1hdIE1pbm9yCiAgICAgIFsgXSBQYXRjaCBvciBN aWNybwogICAgICBbIF0gVW5rbm93biAtLSBBUkMgcmV2aWV3IHJlcXVpcmVkCgog IDIuMyBUeXBlIG9mIHByb2plY3QKICAgICAgSXMgdGhpcyBjYXNlIGEgTGludXgg RmFtaWxpYXJpdHkgcHJvamVjdD8KICAgICAgW1hdIFllcwogICAgICBbIF0gTm8K CiAgMi40IE9yaWdpbmF0aW5nIENvbW11bml0eQogICAgMi40LjEgQ29tbXVuaXR5 IE5hbWUKCiAgICAgICAgaHR0cDovL3d3dy5pbmV0Lm5vL2RhbnRlLwogICAgCiAg ICAyLjQuMiBDb21tdW5pdHkgSW52b2x2ZW1lbnQKICAgICAgSW5kaWNhdGUgU3Vu J3MgaW52b2x2ZW1lbnQgaW4gdGhlIGNvbW11bml0eQogICAgICBbIF0gTWFpbnRh aW5lcgogICAgICBbIF0gQ29udHJpYnV0b3IKICAgICAgW1hdIE1vbml0b3JpbmcK ICAgICAgCiAgICAgIFdpbGwgdGhlIHByb2plY3QgdGVhbSB3b3JrIHdpdGggdGhl IHVwc3RyZWFtIGNvbW11bml0eSB0byByZXNvbHZlCiAgICAgIGFyY2hpdGVjdHVy YWwgaXNzdWVzIG9mIGludGVyZXN0IHRvIFN1bj8KICAgICAgW1hdIFllcyAKICAg ICAgWyBdIE5vIC0gYnJpZWZseSBleHBsYWluCiAgICAgIAogICAgICBXaWxsIHdl IG9yIGFyZSB3ZSBmb3JraW5nIGZyb20gdGhlIGNvbW11bml0eT8KICAgICAgWyBd IFllcyAtIEFSQyByZXZpZXcgcmVxdWlyZWQgcHJpb3IgdG8gZm9ya2luZwogICAg ICBbWF0gTm8KICAgICAgCjMuMCBUZWNobmljYWwgRGVzY3JpcHRpb24KICAzLjEg SW5zdGFsbGF0aW9uICYgU2hhcmFibGUKICAgIDMuMS4xUyBTb2xhcmlzIEluc3Rh bGxhdGlvbiAtIHNlY3Rpb24gb25seSByZXF1aXJlZCBmb3IgU29sYXJpcyBTb2Z0 d2FyZQogICAgICAoc2VlIGh0dHA6Ly9vcGVuc29sYXJpcy5vcmcvb3MvY29tbXVu aXR5L2FyYy9wb2xpY2llcy9pbnN0YWxsLWxvY2F0aW9ucy8gZm9yIGRldGFpbHMp CiAgICAgIERvZXMgdGhpcyBwcm9qZWN0IGZvbGxvdyB0aGUgSW5zdGFsbCBMb2Nh dGlvbnMgYmVzdCBwcmFjdGljZT8KICAgICAgW1hdIFllcyAKICAgICAgWyBdIE5v IC0gQVJDIHJldmlldyByZXF1aXJlZAogICAgICAKICAgICAgRG9lcyB0aGlzIHBy b2plY3QgaW5zdGFsbCBpbnRvIC91c3IgdW5kZXIgW3NiaW58YmlufGxpYnxpbmNs dWRlfG1hbnxzaGFyZV0/CiAgICAgIFtYXSBZZXMKICAgICAgWyBdIE5vIG9yIE4v QQogICAgICAKICAgICAgRG9lcyB0aGlzIHByb2plY3QgaW5zdGFsbCBpbnRvIC9v cHQ/CiAgICAgIFsgXSBZZXMgLSBleHBsYWluIGJlbG93CiAgICAgIFtYXSBObyBv ciBOL0EKICAgICAgCiAgICAgIERvZXMgdGhpcyBwcm9qZWN0IGluc3RhbGwgaW50 byBhIGRpZmZlcmVudCBkaXJlY3Rvcnkgc3RydWN0dXJlPwogICAgICBbIF0gWWVz IC0gQVJDIHJldmlldyByZXF1aXJlZAogICAgICBbWF0gTm8gb3IgTi9BCiAgICAg IAogICAgICBEbyBhbnkgb2YgdGhlIGNvbXBvbmVudHMgb2YgdGhpcyBwcm9qZWN0 IGNvbmZsaWN0IHdpdGggYW55dGhpbmcgdW5kZXIgL3Vzcj8KICAgICAgKHNlZSBo dHRwOi8vb3BlbnNvbGFyaXMub3JnL29zL2NvbW11bml0eS9hcmMvY2FzZWxvZy8y MDA3LzA0Ny8gZm9yIGRldGFpbHMpCiAgICAgIFsgXSBZZXMgLSBleHBsYWluIGJl bG93CiAgICAgIFtYXSBObwogICAgICAKICAgICAgSWYgY29uZmxpY3RzIGV4aXN0 IHRoZW4gd2lsbCB0aGlzIHByb2plY3QgaW5zdGFsbCB1bmRlciAvdXNyL2dudT8K ICAgICAgWyBdIFllcwogICAgICBbIF0gTm8gLSBBUkMgcmV2aWV3IHJlcXVpcmVk CiAgICAgIFtYXSBOL0EKICAgICAgCiAgICAgIElzIHRoaXMgcHJvamVjdCBpbnN0 YWxsaW5nIGludG8gL3Vzci9zZnc/CiAgICAgIFsgXSBZZXMgLSBBUkMgcmV2aWV3 IHJlcXVpcmVkCiAgICAgIFtYXSBObwogICAgICAKCiAgMy4yIEV4cG9ydGVkIExp YnJhcmllcwogICAgICBBcmUgbGlicmFyaWVzIGJlaW5nIGRlbGl2ZXJlZCBieSB0 aGlzIHByb2plY3Q/CiAgICAgIFtYXSBZZXMKICAgICAgWyBdIE5vIC0gY29udGlu dWUgd2l0aCBuZXh0IHNlY3Rpb24gKHNlY3Rpb24gMy4zKQogICAgICAKICAgICAg QXJlIDY0LWJpdCB2ZXJzaW9ucyBvZiB0aGUgbGlicmFyaWVzIGJlaW5nIGRlbGl2 ZXJlZD8KICAgICAgW1hdIFllcwogICAgICBbIF0gTm8gLSBBUkMgcmV2aWV3IHJl cXVpcmVkCiAgICAKICAgICAgQXJlIHN0YXRpYyB2ZXJzaW9ucyBvZiB0aGUgbGli cmFyaWVzIGJlaW5nIGRlbGl2ZXJlZD8KICAgICAgWyBdIFllcyAtIEFSQyByZXZp ZXcgcmVxdWlyZWQKICAgICAgW1hdIE5vIAogICAgICAKICAzLjMgU2VydmljZXMg YW5kIHRoZSAvZXRjIERpcmVjdG9yeQogICAgICAoc2VlIGh0dHA6Ly9vcGVuc29s YXJpcy5vcmcvb3MvY29tbXVuaXR5L2FyYy9wb2xpY2llcy9TTUYtcG9saWN5LykK ICAgICAgRG9lcyB0aGUgcHJvamVjdCBpbnRlZ3JhdGUgYW55dGhpbmcgaW50byAv ZXRjL2luaXQuZCBvciAvZXRjL3JjPy5kPwogICAgICBbIF0gWWVzIC0gQVJDIHJl dmlldyByZXF1aXJlZAogICAgICBbWF0gTm8KICAgICAgCiAgICAgIERvZXMgdGhl IHByb2plY3QgaW50ZWdyYXRlIGFueSBuZXcgZW50cmllcyBpbnRvIC9ldGMvaW5p dHRhYiBvcgogICAgICAvZXRjL2luZXRkLmNvbmY/CiAgICAgIFsgXSBZZXMgLSBB UkMgcmV2aWV3IHJlcXVpcmVkCiAgICAgIFtYXSBObwogICAgICAKICAgICAgRG9l cyB0aGUgcHJvamVjdCBpbnRlZ3JhdGUgYW55IHByaXZhdGUgbm9uLXB1YmxpYyBm aWxlcyBpbnRvIC9ldGMvZGVmYXVsdAogICAgICBvciAvZXRjLyBjb25maWd1cmF0 aW9uIGZpbGVzPwogICAgICBbIF0gWWVzIC0gQVJDIHJldmlldyByZXF1aXJlZAog ICAgICBbWF0gTm8KICAgICAgCiAgICAgIERvZXMgdGhlIHNlcnZpY2UgbWFuaWZl c3RzIG1ldGhvZCBjb250ZXh0IGdyYW50IHJpZ2h0cyBhYm92ZSB0aGF0CiAgICAg IG9mIHRoZSBub2FjY2VzcyB1c2VyIGFuZCBiYXNpYyBwcml2aWxlZ2Ugc2V0Pwog ICAgICBbIF0gWWVzIC0gQVJDIHJldmlldyByZXF1aXJlZAogICAgICBbWF0gTm8K ICAgICAgICAKICAzLjQgU2VjdXJpdHkKICAgIDMuNC4xIFNlY3VyZSBCeSBEZWZh dWx0IAogICAgICAoc2VlIGh0dHA6Ly9vcGVuc29sYXJpcy5vcmcvb3MvY29tbXVu aXR5L2FyYy9wb2xpY2llcy9zZWN1cmUtYnktZGVmYXVsdC8gZm9yIGRldGFpbHMp CiAgICAgIChzZWUgaHR0cDovL3d3dy5vcGVuc29sYXJpcy5vcmcvb3MvY29tbXVu aXR5L2FyYy9wb2xpY2llcy9OSVRTLXBvbGljeS8gZm9yIGRldGFpbHMpCiAgICAg IChzZWUgcGFydHMgb2YgaHR0cDovL29wZW5zb2xhcmlzLm9yZy9vcy9jb21tdW5p dHkvYXJjL3BvbGljaWVzL1NNRi1wb2xpY3kvIGZvcgogICAgICAgYWRkdGlvbmFs IGRldGFpbHMpCiAgICAgIEFyZSB0aGVyZSBhbnkgbmV0d29yayBzZXJ2aWNlcyBw cm92aWRlZCBieSB0aGlzIHByb2plY3Q/CiAgICAgIFtYXSBZZXMKICAgICAgWyBd IE5vIC0gY29udGludWUgd2l0aCB0aGUgbmV4dCBzZWN0aW9uIChzZWN0aW9uIDMu NC4yKQogICAgICAKICAgICAgQXJlIG5ldHdvcmsgc2VydmljZXMgZW5hYmxlZCBi eSBkZWZhdWx0PwogICAgICBbIF0gWWVzIC0gQVJDIHJldmlldyByZXF1aXJlZAog ICAgICBbWF0gTm8KICAgICAgWyBdIE4vQQogICAgICAKICAgICAgQXJlIG5ldHdv cmsgc2VydmljZXMgYXV0b21hdGljYWxseSBlbmFibGVkIGJ5IHRoZSBwcm9qZWN0 IGR1cmluZyBpbnN0YWxsYXRpb24/CiAgICAgIFsgXSBZZXMgLSBBUkMgcmV2aWV3 IHJlcXVpcmVkCiAgICAgIFtYXSBObwogICAgICBbIF0gTi9BCiAgICAgIAogICAg ICBBcmUgaW5ib3VuZCBuZXR3b3JrIGNvbW11bmljYXRpb25zIGRlbmllZCBieSBk ZWZhdWx0PwogICAgICBbIF0gWWVzCiAgICAgIFsgXSBObyAtIEFSQyByZXZpZXcg cmVxdWlyZWQKICAgICAgW1hdIE4vQQogICAgICAKICAgICAgSXMgaW5ib3VuZCBk YXRhIGNoZWNrZWQgdG8gcHJldmVudCBjb250ZW50LWJhc2VkIGF0dGFja3M/CiAg ICAgIFsgXSBZZXMKICAgICAgWyBdIE5vIC0gQVJDIHJldmlldyByZXF1aXJlZAog ICAgICBbWF0gTi9BCiAgICAgIAogICAgICBJcyB0aGUgb3V0Ym91bmQgcmVjZWl2 ZXIgYXV0aGVudGljYXRlZD8KICAgICAgWyBdIFllcwogICAgICBbIF0gTm8gLSBB UkMgcmV2aWV3IHJlcXVpcmVkCiAgICAgIFtYXSBOL0EKICAgICAgCiAgICAgIElz IHRoZSByZWNlaXZlciBhdXRoZW50aWNhdGVkIHByaW9yIHRvIHJlY2VpdmluZyBh bnkgc2Vuc2l0aXZlIG91dGJvdW5kIGNvbW11bmljYXRpb24/CiAgICAgIFsgXSBZ ZXMKICAgICAgWyBdIE5vIC0gQVJDIHJldmlldyByZXF1aXJlZAogICAgICBbWF0g Ti9BCiAgICAgIAogICAgMy40LjIgQXV0aG9yaXphdGlvbgogICAgICAoc2VlIGh0 dHA6Ly9vcGVuc29sYXJpcy5vcmcvb3MvY29tbXVuaXR5L2FyYy9iZXN0cHJhY3Rp Y2VzL3JiYWMtaW50cm8vIGFuZAoJICAgaHR0cDovL29wZW5zb2xhcmlzLm9yZy9v cy9jb21tdW5pdHkvYXJjL2Jlc3RwcmFjdGljZXMvcmJhYy1wcm9maWxlcy8gYW5k CgkgICBodHRwOi8vb3BlbnNvbGFyaXMub3JnL29zL2NvbW11bml0eS9hcmMvYmVz dHByYWN0aWNlcy9yYmFjLXByb2ZpbGVzLwogICAgICAgICAgIGZvciBkZXRhaWxz KQogICAgICBBcmUgdGhlcmUgYW55IHNldHVpZC9zZXRnaWQgcHJpdmlsZWdlZCBi aW5hcmllcyBpbiB0aGUgcHJvamVjdD8KICAgICAgWyBdIFllcyAtIEFSQyByZXZp ZXcgcmVxdWlyZWQKICAgICAgW1hdIE5vIC0gY29udGludWUgd2l0aCBuZXh0IHNl Y3Rpb24gKHNlY3Rpb24gMy40LjMpCiAgICAgIAogICAgICBJZiB5ZXMgdGhlbiBh cmUgdGhlIHNldHVpZC9zZXRnaWQgcHJpdmlsZWdlcyBoYW5kbGVkIGJ5IHRoZSB1 c2Ugb2Ygcm9sZXM/CiAgICAgIFsgXSBZZXMKICAgICAgWyBdIE5vIC0gQVJDIHJl dmlldyByZXF1aXJlZAoKICAgIDMuNC4zIEF1ZGl0aW5nCiAgICAgIChzZWUgaHR0 cDovL29wZW5zb2xhcmlzLm9yZy9vcy9jb21tdW5pdHkvYXJjL3BvbGljaWVzL2F1 ZGl0LXBvbGljeS8gZm9yIGRldGFpbHMpCiAgICAgIChzZWUgaHR0cDovL29wZW5z b2xhcmlzLm9yZy9vcy9jb21tdW5pdHkvYXJjL2Nhc2Vsb2cvMjAwMy8zOTcgZm9y IGRldGFpbHMpCiAgICAgIERvZXMgdGhpcyBjb21wb25lbnQgY29udGFpbiBhZG1p bmlzdHJhdGl2ZSBvciBzZWN1cml0eSBlbmZvcmNpbmcgc29mdHdhcmU/CiAgICAg IFtYXSBZZXMgLSBBUkMgcmV2aWV3IHJlcXVpcmVkCiAgICAgIFsgXSBObyAtIGNv bnRpbnVlIHRvIG5leHQgc2VjdGlvbiAoc2VjdGlvbiAzLjQuNCkKICAgICAgCiAg ICAgIChzZWUgaHR0cDovL29wZW5zb2xhcmlzLm9yZy9vcy9jb21tdW5pdHkvYXJj L2Nhc2Vsb2cvMjAwMy8zOTcgZm9yIGRldGFpbHMpCiAgICAgIERvIHRoZSBjb21w b25lbnRzIGNyZWF0ZSBhdWRpdCBsb2dzIGRldGFpbGluZyB3aGF0IHRvb2sgcGxh Y2UgaW5jbHVkaW5nIHdoYXQgZXZlbnQKICAgICAgdG9vayBwbGFjZSwgd2hvIHdh cyBpbnZvbHZlZCwgd2hlbiB0aGUgZXZlbnQgdG9vayBwbGFjZT8KICAgICAgWyBd IFllcyAtIEFSQyBjb250cmFjdCBhbmQgQXVkaXQgcHJvamVjdCB0ZWFtIHJldmll dyByZXF1aXJlZAogICAgICBbWF0gTm8gLSBBUkMgcmV2aWV3IHJlcXVpcmVkCiAg ICAgICAgCiAgICAgICAgCiAgICAzLjQuNCBBdXRoZW50aWNhdGlvbgogICAgICAo c2VlIGh0dHA6Ly9vcGVuc29sYXJpcy5vcmcvb3MvY29tbXVuaXR5L2FyYy9wb2xp Y2llcy9QQU0vKQogICAgICBEbyB0aGUgY29tcG9uZW50cyBjb250YWluIGFueSBh dXRoZW50aWNhdGlvbiBjb2RlPwogICAgICBbWF0gWWVzCiAgICAgIFsgXSBObyAt IGNvbnRpbnVlIHRvIG5leHQgc2VjdGlvbiAoc2VjdGlvbiAzLjQuNSkKICAgICAg CiAgICAgIElmIHllcyBkbyB0aGUgY29tcG9uZW50cyB1c2UgUEFNIChwbHVnYWJs ZSBhdXRoZW50aWNhdGlvbiBtb2R1bGVzKSBmb3IgYXV0aGVudGljYXRpb24/CiAg ICAgIFtYXSBZZXMKICAgICAgWyBdIE5vIC0gQVJDIHJldmlldyByZXF1aXJlZAog ICAgICAKICAgICAgSWYgeWVzIGlzIGEgc2luZ2xlIFBBTSBzZXNzaW9uIG1haW50 YWluZWQgZHVyaW5nIGF1dGhlbnRpY2F0aW9uPwogICAgICBbWF0gWWVzCiAgICAg IFsgXSBObyAtIEFSQyByZXZpZXcgcmVxdWlyZWQKICAgICAgCiAgICAgIElmIHll cyBhcmUgdGhlIGNvbXBvbmVudHMgc3VmZmljaWVudGx5IHByaXZpbGVnZWQgdG8g YWxsb3cgdGhlIHJlcXVlc3RlZCAKICAgICAgb3BlcmF0aW9ucyAoYXV0aGVudGlj YXRpb24sIHBhc3N3b3JkIGNoYW5nZSwgcHJvY2VzcyBjcmVkZW50aWFsIG1hbmlw dWxhdGlvbiwgCiAgICAgIGF1ZGl0IHN0YXRlIGluaXRpYWxpemF0aW9uKT8KICAg ICAgW1hdIFllcyAtIGJyaWVmbHkgZGVzY3JpYmUgYmVsb3cKICAgICAgWyBdIE5v IC0gQVJDIHJldmlldyByZXF1aXJlZAoKCURhbnRlIHVzZXMgUEFNIG9ubHkgZm9y IGF1dGhlbnRpY2F0aW9uIGFuZCBhY3F1aXJlcyBzdWZmaWNpZW50IHByaXZpbGVn ZXMgYmVmb3JlCgljYWxsaW5nIHBhbSBvcGVyYXRpb25zLgogICAgICAKICAgIDMu NC41IFBhc3N3b3JkcwogICAgICAoc2VlIGh0dHA6Ly9vcGVuc29sYXJpcy5vcmcv b3MvY29tbXVuaXR5L2FyYy9iZXN0cHJhY3RpY2VzL3Bhc3N3b3Jkcy1jbGkvIGFu ZAogICAgICAgICAgIGh0dHA6Ly9vcGVuc29sYXJpcy5vcmcvb3MvY29tbXVuaXR5 L2FyYy9iZXN0cHJhY3RpY2VzL3Bhc3N3b3Jkcy1maWxlcy8gZm9yIGRldGFpbHMp CiAgICAgIERvIGFueSBvZiB0aGUgY29tcG9uZW50cyBmb3IgdGhlIHByb2plY3Qg ZGVhbCB3aXRoIHBhc3N3b3Jkcz8KICAgICAgW1hdIFllcwogICAgICBbIF0gTm8g LSBjb250aW51ZSB0byBuZXh0IHNlY3Rpb24gKHNlY3Rpb24gMy40LjYpCiAgICAg IAogICAgICBJZiB5ZXMgYXJlIHRoZXNlIHBhc3N3b3JkcyBlbnRlcmVkIHZpYSB0 aGUgQ0xJIG9yIGVudmlyb25tZW50PwogICAgICBbWF0gWWVzIC0gQVJDIHJldmll dyByZXF1aXJlZAogICAgICBbIF0gTm8KCglwYXNzd29yZHMgYXJlIGVudGVyZWQg dmlhIENMSS4gCiAgICAgIAogICAgICBBcmUgcGFzc3dvcmRzIHN0b3JlZCB3aXRo aW4gdGhlIGZpbGUgc3lzdGVtIGZvciB0aGUgY29tcG9uZW50PwogICAgICBbIF0g WWVzCiAgICAgIFtYXSBObyAtIGNvbnRpbnVlIHRvIG5leHQgc2VjdGlvbiAoc2Vj dGlvbiAzLjQuNikKCiAgICAgCWRhbnRlIGNhbiB3b3JrIHdpdGggU09DS1NfVVNF Uk5BTUUgJiBTT0NLU19QQVNTV09SRCB2YXJpYWJsZXMgaWYgc2V0IGluIHRoZSBl bnZpcm9ubWVudC4KIAogICAgICBJZiB5ZXMgYXJlIHRoZSBwZXJtaXNzaW9ucyBv biB0aGUgZmlsZSBzdWNoIHRvIHByb3RlY3QgZXhwb3NpbmcgdGhlIHBhc3N3b3Jk KHMpPwogICAgICBbIF0gWWVzCiAgICAgIFsgXSBObyAtIEFSQyByZXZpZXcgcmVx dWlyZWQKICAgICAgCiAgICAzLjQuNiBHZW5lcmFsIFNlY3VyaXR5IFF1ZXN0aW9u cwogICAgICAoc2VlIGh0dHA6Ly9vcGVuc29sYXJpcy5vcmcvb3MvY29tbXVuaXR5 L2FyYy9iZXN0cHJhY3RpY2VzL3NlY3VyaXR5LXF1ZXN0aW9ucy8gZm9yIGRldGFp bHMpCiAgICAgIEFyZSB0aGVyZSBhbnkgbmV0d29yayBwcm90b2NvbHMgdXNlZCBi eSB0aGlzIHByb2plY3Q/CiAgICAgIFtYXSBZZXMKICAgICAgWyBdIE5vIC0gY29u dGludWUgd2l0aCB0aGUgbmV4dCBzZWN0aW9uIChzZWN0aW9uIDMuNSkKICAgICAg CiAgICAgIERvIHRoZSBjb21wb25lbnRzIHVzZSBzdGFuZGFyZCBuZXR3b3JrIHBy b3RvY29scz8KICAgICAgW1hdIFllcwogICAgICBbIF0gTm8gLSBBUkMgcmV2aWV3 IHJlcXVpcmVkCiAgICAgIAogICAgICBEbyBuZXR3b3JrIHNlcnZpY2VzIGZvciB0 aGUgcHJvamVjdCBtYWtlIGRlY2lzaW9ucyBiYXNlZCB1cG9uIHVzZXIsIGhvc3Qg b3IgCiAgICAgIHNlcnZpY2UgaWRlbnRpdGllcz8KICAgICAgW1hdIFllcyAtIGV4 cGxhaW4gYmVsb3cKICAgICAgWyBdIE5vCiAgICAgIFsgXSBOL0EKCglEYW50ZSwg bGlrZSBhIHR5cGljYWwgU29ja3Mgc2VydmVyLCBhdXRoZW50aWNhdGVzIHVzZXJz IGJhc2VkIG9uIHZhcmlvdXMgbWV0aG9kcyAKCWxpa2UsIFBBTSwgdXNlcm5hbWUg ZXRjLgoJZGFudGUgYWxzbyBtYWtlcyByb3V0aW5nIGRlY2lzaW9ucyBiYXNlZCBv biB0aGUgaG9zdHMgY29uZmlndXJlZCBpbiB0aGUgc29ja3MuY29uZiBzYW1wbGUg ZmlsZS4gCiAgICAgIAogICAgICBEbyB0aGUgY29tcG9uZW50cyBtYWtlIHVzZSBv ZiBzZWNyZXQgaW5mb3JtYXRpb24gZHVyaW5nIGF1dGhlbnRpY2F0aW9uIGFuZC9v cgogICAgICBhdXRob3JpemF0aW9uPwogICAgICBbWF0gWWVzIC0gZXhwbGFpbiBi ZWxvdwogICAgICBbIF0gTm8KICAgICAgWyBdIE4vQQoKCURhbnRlIHVzZXMgcGFz c3dvcmRzIGZvciBhdXRoZW50aWNhdGlvbi4KICAKICAzLjUgTmV0d29ya2luZwog ICAgICBEbyB0aGUgY29tcG9uZW50cyBhY2Nlc3MgdGhlIG5ldHdvcms/CiAgICAg IFtYXSBZZXMKICAgICAgWyBdIE5vIC0gY29udGludWUgd2l0aCB0aGUgbmV4dCBz ZWN0aW9uIChzZWN0aW9uIDMuNikKICAgICAgCiAgICAgIElmIHllcyBkbyB0aGUg Y29tcG9uZW50cyBzdXBwb3J0IElQdjY/CiAgICAgIFtYXSBZZXMgCiAgICAgIFsg XSBObyAtIEFSQyByZXZpZXcgcmVxdWlyZWQKICAgICAgICAgIAogIDMuNiBDb3Jl IFNvbGFyaXMgQ29tcG9uZW50cwogICAgICBEbyB0aGUgY29tcG9uZW50cyBvZiB0 aGlzIHByb2plY3QgY29tcGV0ZSB3aXRoIG9yIGR1cGxpY2F0ZSBjb3JlIAogICAg ICBTb2xhcmlzIGNvbXBvbmVudHM/CiAgICAgIFsgXSBZZXMgLSBBUkMgcmV2aWV3 IHJlcXVpcmVkCiAgICAgIFtYXSBObyAKICAgICAgCiAgICAgIEV4YW1wbGVzIG9m IENvcmUgU29sYXJpcyBDb21wb25lbnRzIGluY2x1ZGUgYnV0IGFyZSBub3QgbGlt aXRlZCB0bzoKICAgICAgCiAgICAgICAgU2VjdXJlIEJ5IERlZmF1bHQKICAgICAg ICBBdXRob3JpemF0aW9ucwogICAgICAgIFBBTSAtLSBQbHVnYWJsZSBBdXRoZW50 aWNhdGlvbiBNb2R1bGUKICAgICAgICBQcml2aWxlZ2UKICAgICAgICBQUk0gLS0g UHJvY2VzcyBSaWdodHMgTWFuYWdlbWVudCAtLSBQcml2aWxlZ2UKICAgICAgICBB dWRpdAogICAgICAgIHhWbSAtLSBWaXJ0dWFsaXphdGlvbgogICAgICAgIHpvbmVz IC8gU29sYXJpcyBDb250YWluZXJzCiAgICAgICAgUFJNIC0tIFByb2Nlc3MgUmln aHRzIE1hbmFnZW1lbnQKICAgICAgICBSQkFDIC0tIFJvbGUgQmFzZWQgQWNjZXNz IENvbnRyb2wKICAgICAgICBUWCAvIFRydXN0ZWQgRXh0ZW5zaW9ucwogICAgICAg IFpGUwogICAgICAgIFNNRiAtLSBTZXJ2aWNlIE1hbmFnZW1lbnQgRmFjaWxpdHkK ICAgICAgICBGTUEgLS0gRmF1bHQgTWFuYWdlbWVudCBBcmNoaXRlY3R1cmUKICAg ICAgICBTQ0YgLS0gU21hcnQgQ2FyZCBGYWNpbGl0eQogICAgICAgIElQc2VjCiAg ICAgICAgCjQuMCBJbnRlcmZhY2VzCiAgKHNlZSBodHRwOi8vd3d3Lm9wZW5zb2xh cmlzLm9yZy9vcy9jb21tdW5pdHkvYXJjL3BvbGljaWVzL2ludGVyZmFjZS10YXhv bm9teS8gZm9yIGRldGFpbHMpCiAgNC4xIEV4cG9ydGVkIEludGVyZmFjZXMKIAog ICAgICAgICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsKICAgICAgICAg fCAgIHwgSW50ZXJmYWNlIE5hbWUgICAgICB8IENsYXNzaWZpY2F0aW9uICAgICAg IHwgQ29tbWVudHMgICAgICAgICAgICAgICAgICB8CiAgICAgICAgIHwtLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tfAogICAgICAgICB8IDEgfCBsaWJkc29ja3Mu c28gICAgICAgIHwgUHJvamVjdCBQcml2YXRlICAgICAgfCBTT0NLUyBkYWVtb24g bGlicmFyeSAgICAgIHwKICAgICAgICAgfCAgIHwtLS0tLS0tLS0tLS0tLS0tLS0t LS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS18CiAgICAgICAgIHwgMiB8IGxpYnNvY2tzLnNvICAgICAgICAgfCBDb21t aXR0ZWQgICAgICAgICAgICB8IFNPQ0tTIGxpYnJhcnkgICAgICAgICAgICAgfAog ICAgICAgICB8ICAgfC0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLXwKICAgICAgICAg fCAzIHwgc29ja3NpZnkgICAgICAgICAgICB8IFVuY29tbWl0dGVkICAgICAgICAg IHwgU09DS1MgY2xpZW50IHNjcmlwdCAgICAgICB8CiAgICAgICAgIHwgICB8LS0t LS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tfAogICAgICAgICB8IDQgfCBzb2NrZCAgICAg ICAgICAgICAgIHwgVW5jb21taXR0ZWQgICAgICAgICAgfCBTT0NLUyBzZXJ2ZXIg ZGFlbW9uICAgICAgIHwKICAgICAgICAgfCAgIHwtLS0tLS0tLS0tLS0tLS0tLS0t LS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS18CiAgICAgICAgIHwgNSB8IHNvY2tzLmNvbmYgICAgICAgICAgfCBVbmNv bW1pdHRlZCAgICAgICAgICB8IENsaWVudCBjb25maWd1cmF0aW9uIGZpbGUgfAog ICAgICAgICB8ICAgfC0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLXwKICAgICAgICAg fCA2IHwgc29ja2QuY29uZiAgICAgICAgICB8IFVuY29tbWl0dGVkICAgICAgICAg IHwgU2VydmVyIGNvbmZpZ3VyYXRpb24gZmlsZSB8CiAgICAgICAgIHwgICB8LS0t LS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tfAogICAgICAgICB8IDcgfCBTVU5XbGlic29j a3MgICAgICAgIHwgUHVibGljL0NvbW1pdHRlZCAgICAgfCBDbGllbnQgcGFja2Fn ZSAgICAgICAgICAgIHwKICAgICAgICAgfCAgIHwtLS0tLS0tLS0tLS0tLS0tLS0t LS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS18CiAgICAgICAgIHwgOCB8IFNVTldkYW50ZXUgICAgICAgICAgfCBQdWJs aWMvQ29tbWl0dGVkICAgICB8IFNlcnZlciBwYWNrYWdlIChVc2VyKSAgICAgfAog ICAgICAgICB8ICAgfC0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLXwKICAgICAgICAg fCA5IHwgU1VOV2RhbnRlciAgICAgICAgICB8IFB1YmxpYy9Db21taXR0ZWQgICAg IHwgU2VydmVyIHBhY2thZ2UgKFJvb3QpICAgICB8CgkgfCAgIHwtLS0tLS0tLS0t LS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS18CgkgfDEwIHwgbmV0d29yay9zb2NrcwkgICB8IFB1Ymxp Yy9Db21taXR0ZWQJICB8IFNNRiBTZXJ2aWNlIG5hbWUgICAJICAgICAgfAoJIHwg ICB8LS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tfAoJIHwxMSB8IHNvY2tkCQkgICB8 IFVuY29tbWl0dGVkCSAgfCBQQU0gU2VydmljZW5hbWUJICAgICAgfAogICAgICAg ICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsKIAogICAgCiAgNC4yIElt cG9ydGVkIEludGVyZmFjZXMKICAgIEludGVyZmFjZSBOYW1lCQlDbGFzc2lmaWNh dGlvbiAgICAgICBDb21tZW50cwogICAgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tIC0tLS0tLS0tLS0tLS0tLS0tLS0tIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tCiAgIAoJTk9ORSAKICAgIApSQyByZXZpZXcgcmVxdWlyZWQKICAgIAogICAg ICBBcmUgc3RhdGljIHZlcnNpb25zIG9mIHRoZSBsaWJyYXJpZXMgYmVpbmcgZGVs aXZlcmVkPwogICAgICBbIF0gWWVzIC0gQVJDIHJldmlldyByZXF1aXJlZAogICAg ICBbWF0gTm8gCiAgICAgIAogIDMuMyBTZXJ2aWNlcyBhbmQgdGhlIC9ldGMgRGly ZWN0b3J5CiAgICAgIChzZWUgaHR0cDovL29wZW5zb2xhcmlzLm9yZy9vcy9jb21t dW5pdHkvYXJjL3BvbGljaWVzL1NNRi1wb2xpY3kvKQogICAgICBEb2VzIHRoZSBw cm9qZWN0IGludGVncmF0ZSBhbnl0aGluZyBpbnRvIC9ldGMvaW5pdC5kIG9yIC9l dGMvcmM/LmQ/CiAgICAgIG1hdGVyaWFsL2RhbnRlX29uZXBhZ2VyX3YyLnR4dAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwNjAwADA0MDcxNTYAMDAwMDAxMgAwMDAw MDAzMTU1MgAxMTExNTQ0NTI1MwAwMDE3MzA1ADAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdXN0YXIAMDBtbjEzMzc2 NgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHN0YWZmAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAMDAwMDE0NgAwMDAwMDAzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA VGVtcGxhdGUgVmVyc2lvbjogQCgjKW9uZXBhZ2VyLnR4dCAxLjM1IDA3LzExLzA3 IFNNSQpDb3B5cmlnaHQgMjAwNyBTdW4gTWljcm9zeXN0ZW1zCgoxLiBJbnRyb2R1 Y3Rpb24KICAgMS4xLiBQcm9qZWN0L0NvbXBvbmVudCBXb3JraW5nIE5hbWU6CglE YW50ZTogQSBTb2NrcyBzZXJ2ZXIgYW5kIGNsaWVudCBpbXBsZW1lbnRhdGlvbgoK ICAgMS4yLiBOYW1lIG9mIERvY3VtZW50IEF1dGhvci9TdXBwbGllcjoKCU1heXVy ZXNoIE5pcmhhbGkKCiAgIDEuMy4gRGF0ZSBvZiBUaGlzIERvY3VtZW50OgoJMDgv MjYvMjAwOAoJCgkxLjMuMS4gRGF0ZSB0aGlzIHByb2plY3Qgd2FzIGNvbmNlaXZl ZDoKCQlOL0EKCiAgIDEuNC4gTmFtZSBvZiBNYWpvciBEb2N1bWVudCBDdXN0b21l cihzKS9Db25zdW1lcihzKToKCTEuNC4xLiBUaGUgUEFDIG9yIENQVCB5b3UgZXhw ZWN0IHRvIHJldmlldyB5b3VyIHByb2plY3Q6CgkJU29sYXJpcwoKCTEuNC4yLiBU aGUgQVJDKHMpIHlvdSBleHBlY3QgdG8gcmV2aWV3IHlvdXIgcHJvamVjdDoKCQlQ U0FSQwoKCTEuNC4zLiBUaGUgRGlyZWN0b3IvVlAgd2hvIGlzICJTcG9uc29yaW5n IiB0aGlzIHByb2plY3Q6CgkJQ2hyaXMuQXJtZXNAU3VuLkNPTQoKCTEuNC40LiBU aGUgbmFtZSBvZiB5b3VyIGJ1c2luZXNzIHVuaXQ6CgkJU29sYXJpcyAtIFJQRQoK ICAgMS41LiBFbWFpbCBBbGlhc2VzOgogICAgCTEuNS4xLiBSZXNwb25zaWJsZSBN YW5hZ2VyOiBMdWthcy5Sb3ZlbnNreUBTdW4uQ09NCiAgICAJMS41LjIuIFJlc3Bv bnNpYmxlIEVuZ2luZWVyOiBNYXl1cmVzaC5OaXJoYWxpQFN1bi5DT00KICAgIAkx LjUuMy4gTWFya2V0aW5nIE1hbmFnZXI6IAoJMS41LjQuIEludGVyZXN0IExpc3Q6 ICBzZndudi1kaXNjdXNzQG9wZW5zb2xhcmlzLm9yZwoKMi4gUHJvamVjdCBTdW1t YXJ5CiAgIDIuMS4gUHJvamVjdCBEZXNjcmlwdGlvbjoKCglEYW50ZSBpcyBhIGNp cmN1aXQtbGV2ZWwgZmlyZXdhbGwvcHJveHkgdGhhdCBjYW4gYmUgdXNlZCB0byBw cm92aWRlIAoJY29udmVuaWVudCBhbmQgc2VjdXJlIG5ldHdvcmsgY29ubmVjdGl2 aXR5IHRvIGEgd2lkZSByYW5nZSBvZiBob3N0cyAKCXdoaWxlIHJlcXVpcmluZyBv bmx5IHRoZSBzZXJ2ZXIuIERhbnRlIHJ1bnMgb24gdG8gaGF2ZSBleHRlcm5hbCAK CW5ldHdvcmsgY29ubmVjdGl2aXR5LgoKICAgMi4yLiBSaXNrcyBhbmQgQXNzdW1w dGlvbnM6CgoJRGFudGUgaXMgYSB0aGlyZCBwYXJ0eSBTb2NrcyBzZXJ2ZXIgYW5k IGNsaWVudCBpbXBsZW1lbnRhdGlvbi4gVGhlIAoJY3VycmVudCB2ZXJzaW9uICgx LjEuMTkpIGlzIHN0YWJsZSBhbmQgaXQgd2FzIHJlbGVhc2VkIGluCglKYW51YXJ5 IDIwMDYuIFNpbmNlIHRoZW4sIHRoZXJlIGhhcyBiZWVuIG5vIHJlbGVhc2VzIG9m IHRoaXMgcHJvZHVjdC4KCglBbnkgYnVncyBmb3VuZCBmb3IgdGhpcyBwcm9kdWN0 IHdpbGwgYmUgcmVkaXJlY3RlZCB0byB0aGUgb3duZXJzLiBDb25zaWRlcmluZwoJ dGhhdCB0aGVyZSBzZWVtcyB0byBiZSBubyBhY3RpdmUgZGV2ZWxvcG1lbnQgb24g dGhpcyBwcm9kdWN0IHNpbmNlIDIwMDYsCgl0aGUgYnVncy9pc3N1ZXMgbWF5IHRh a2UgbG9uZ2VyIHRvIHJlc29sdmUuCgogICAyLjMuIFNNRgoKICAgICAgICBEYW50 ZSBTT0NLUyBzZXJ2ZXIgd2lsbCBiZSBtYW5hZ2VkIGFzIGEgU01GIHNlcnZpY2Uu IFRoZSBEYW50ZSBzZXJ2ZXIgCgl3b3VsZCBydW4gd2l0aCBMZWFzdCBQcml2aWxl Z2Ugc3BlY2lmaWVkIHRocm91Z2ggdGhlIFNNRiBtYW5pZmVzdC4gIAoJSXQgd291 bGQgbm90IG5lZWQgdG8gaGF2ZSBhbnkgb2YgdGhlIFNVSUQvU0dJRCBiaXRzIGlu IHRoZSBmaWxlIHN5c3RlbSAKCXRvIGJlIHNldCBub3Igd291bGQgdGhlIGRhZW1v biBpdHNlbGYgbmVlZCBhbiBSQkFDIGVudHJ5LCBiZWNhdXNlIFNNRiAKCSdzdGFy dCcgbWV0aG9kIHdvdWxkIHNldCB0aGUgcHJpdmlsZWdlcyBhbmQgVUlEL0dJRCBh cyBuZWNlc3NhcnkgZm9yIG5vcm1hbCAKCW9wZXJhdGlvbi4gCgoJU01GIHNlcnZp Y2UgZm9yIERhbnRlIFNPQ0tTIHNlcnZlciB3aWxsIGJlIGFkZGVkIHVuZGVyIG5l dHdvcmsgY2F0ZWdvcnkgYXMKCW5ldHdvcmsvc29ja3MuIFRoZSBwYWNrYWdlIHdp bGwgYWRkIHRoZSBtYW5pZmVzdCBmaWxlIGFuZCB0aGUgU01GIG1ldGhvZCBhcyAK CWJlbG93LAoKCS92YXIvc3ZjL21hbmlmZXN0L25ldHdvcmsvc29ja3MueG1sIAoJ L2xpYi9zdmMvbWV0aG9kL3NvY2tzCgoJTWV0aG9kIGNyZWRlbnRpYWxzIGZvciBk YW50ZSBTTUYgc2VydmljZSB3aWxsIGJlICJyb290IiB1c2VyCiAgIAlhbmQgInJv b3QiIGdyb3VwLiBTZWUgU2VjdGlvbiA0LjExIChTZWN1cml0eSBJbXBhY3QpIGZv ciBtb3JlIGRldGFpbHMuCgoJVGhlIFNNRiBzZXJ2aWNlIGZvciBEYW50ZSB3aWxs IGJlIGRpc2FibGVkIGJ5IGRlZmF1bHQuCgoJRGFudGUgc29ja3Mgc2VydmVyIHJl YWRzIHRoZSBjb25maXJndXJhdGlvbiBmaWxlIHdoZW4gc3RhcnRlZC4gVGhlCglj b25maWd1cmF0aW9uIGZpbGUgcmVxdWlyZXMgY2VydGFpbiBwYXJhbWV0ZXJzIHRv IGJlIHNwZWNpZmllZCBmb3IgCgl0aGUgc2VydmVyIHRvIHJ1biAoZS5nLiB0aGUg YWRkcmVzcy9pbnRlcmZhY2UgYW5kIHBvcnQgZm9yIGFsbCB0aGUgCglpbmNvbWlu ZyByZXF1ZXN0cykuIFNpbmNlIHRoZXJlIGNhbm5vdCBiZSBhbnkgcGxhdXNpYmxl IGRlZmF1bHQgdmFsdWUgCgl0byBzdWNoIHBhcmFtZXRlcnMsIHRoZSBjb25maWcg ZmlsZSBzdGlsbCBuZWVkcyB0byBiZSB1c2VkIGFsdGhvdWdoCglpdCBpcyBub3Qg YSByZWNvbW1lbmRlZCBwcmFjdGljZSBmb3IgU01GLiBUaGUgc29ja3Mgc2VydmVy IHdpbGwgZ28KCWludG8gbWFpbnRlbmFuY2UgbW9kZSBpZiBjb25maWd1cmF0aW9u IGZpbGUgaXMgbm90IHVwZGF0ZWQgd2l0aCB2YWxpZAoJdmFsdWVzIHRvIHRoZSBu ZWNlc3NhcnkgcGFyYW1ldGVycy4gCgkKCUhlbmNlLCB0byBlbmFibGUgZGFudGUg c2VydmVyLCBmaXJzdCwgdGhlIC9ldGMvc29ja2QuY29uZiBzaG91bGQKCWJlIHBv cHVsYXRlZCB3aXRoIHZhbGlkIGluZm9ybWF0aW9uIGFuZCB0aGVuLCB0aGUgc2Vy dmljZSBzaG91bGQgYmUgCgllbmFibGVkLiAKCjMuIEJ1c2luZXNzIFN1bW1hcnkK IAogICAzLjEuIFByb2JsZW0gQXJlYToKCglEYW50ZSBwcm92aWRlcyBjb252aW5p ZW50IGFuZCBzZWN1cmUgbmV0d29yayBjb25uZWN0aXZpdHkKCWZyb20gYmVoaW5k IGEgZmlyZXdhbGwgdXNpbmcgU29ja3MgcHJvdG9jb2wuCgoJRGFudGUgaXMgYSBm cmVlIGltcGxlbWVudGF0aW9uIG9mIHRoZSBwcm94eSBwcm90b2NvbHMgc29ja3Mg dmVyc2lvbiA0LAoJc29ja3MgdmVyc2lvbiA1IChyZmMxOTI4KSBhbmQgbXNwcm94 eS4gSXQgY2FuIGJlIHVzZWQgYXMgYSBmaXJld2FsbAoJYmV0d2VlbiBuZXR3b3Jr cy4KCiAgIDMuMi4gTWFya2V0L1JlcXVlc3RlcjoKCglPcGVuU29sYXJpcyBDb21t dW5pdHkKCiAgIDMuMy4gQnVzaW5lc3MgSnVzdGlmaWNhdGlvbjoKCglJbnRlZ3Jh dGlvbiBvZiBEYW50ZSB3aWxsIGFsbG93IHRoZSBTb2xhcmlzIGhvc3QgdG8gYWN0 IGFzIGEgU29ja3Mgc2VydmVyLgoJRGFudGUncyBjbGllbnQgaW1wbGVtZW50YXRp b24gYWxsb3dzIHVzZXJzIHRvIGNvbm5lY3Qgb3V0c2lkZSB0aGVpciBzZWN1cmVk IG5ldHdvcmsgCglpbiBhIHVzZXIgZnJpZW5kbHkgbWFubmVyLiBTdWNoIHNvY2tz IGNsaWVudC1zZXJ2ZXIgaW1wbGVtZW50YXRpb24gaGFzIGJlZW4gCgltaXNzaW5n IGZyb20gIFNvbGFyaXMuCgoJQ3VycmVudGx5LCBpbiBvcmRlciB0byBoYXZlIHNv Y2tzIHNlcnZlci9jbGllbnQgZnVuY3Rpb25hbGl0eSBvbiBTb2xhcmlzLAoJdGhl IHVzZXJzIG5lZWQgdG8gY29tcGlsZS1pbnN0YWxsIGRhbnRlIChvciBzaW1pbGFy IGltcGxlbWVudGF0aW9uKSBvbiB0aGVpciBvd24uCgkKCVRoZSBzZWFtbGVzcyBp bnRlZ3JhdGlvbiBvZiBEYW50ZSB3aXRoIG90aGVyIFNvbGFyaXMgZmVhdHVyZXMg KHN1Y2ggYXMgU01GKQoJd2lsbCBwcm92aWRlIGJldHRlciBvdXQtb2YtdGhlLWJv eCB1c2FiaWxpdHkuCgogICAzLjQuIENvbXBldGl0aXZlIEFuYWx5c2lzOgoKCU1v c3Qgb2YgdGhlIG90aGVyIFVuaXggYmFzZWQgT3BlcmF0aW5nIHN5c3RlbXMgc3Vw cG9ydCBEYW50ZS4KCVRoZSBjb21wZXRpdG9ycyBpbiB0aGlzIHJlZ2FyZCBhcmUg cmVhbGx5IHRoZSBPcGVyYXRpbmcgU3lzdGVtcwoJdGhhdCBpbmNsdWRlIHN1Y2gg ZnVuY3Rpb25hbGl0eSB0b2RheS4KCiAgIDMuNS4gT3Bwb3J0dW5pdHkgV2luZG93 L0V4cG9zdXJlOgoKCVRoZSB0aGlyZCBwYXJ0eSBwcm9kdWN0IGlzIHJlYWR5IHRv IGJlIGludGVncmF0ZWQuCgogICAzLjYuIEhvdyB3aWxsIHlvdSBrbm93IHdoZW4g eW91IGFyZSBkb25lPzoKCglUaGUgcHJvZHVjdCBpcyByZWFkeSB0byBiZSBpbnRl Z3JhdGVkLgoKNC4gVGVjaG5pY2FsIERlc2NyaXB0aW9uOgogICAgNC4xLiBEZXRh aWxzOgoKCWh0dHA6Ly93d3cuaW5ldC5uby9kYW50ZS8KCglEYW50ZSBpcyBhIGNp cmN1aXQtbGV2ZWwgZmlyZXdhbGwvcHJveHkgdGhhdCBjYW4gYmUgdXNlZCB0byBw cm92aWRlIAoJY29udmVuaWVudCBhbmQgc2VjdXJlIG5ldHdvcmsgY29ubmVjdGl2 aXR5IHRvIGEgd2lkZSByYW5nZSBvZiBob3N0cyAKCXdoaWxlIHJlcXVpcmluZyBv bmx5IHRoZSBzZXJ2ZXIgRGFudGUgcnVucyBvbiB0byBoYXZlIGV4dGVybmFsIG5l dHdvcmsgCgljb25uZWN0aXZpdHkuCgoJT25jZSBpbnN0YWxsZWQsIERhbnRlIGNh biBpbiBtb3N0IGNhc2VzIGJlIG1hZGUgdHJhbnNwYXJlbnQgdG8gdGhlIAoJY2xp ZW50cyB3aGlsZSBvZmZlcmluZyBkZXRhaWxlZCBhY2Nlc3MgY29udHJvbCBhbmQg bG9nZ2luZyBmYWNpbGl0aWVzIAoJdG8gdGhlIHNlcnZlciBhZG1pbmlzdHJhdG9y LiAKCiAgICA0LjIuIEJ1Zy9SRkUgTnVtYmVyKHMpOgoKCTY2NjE5NjEKICAgIAog ICAgNC4zLiBJbiBTY29wZToKCiAgICA0LjQuIE91dCBvZiBTY29wZToKICAgIAog ICAgNC41LiBJbnRlcmZhY2VzOgoKCVRoaXMgaW50ZWdyYXRpb24gd2lsbCBub3Qg bW9kaWZ5IG9yIGRlbGV0ZSBhbnkgaW50ZXJmYWNlcy4gSXQgd2lsbAoJYWRkIG9u ZSBiaW5hcnkgZm9yIHRoZSBzZXJ2ZXIgKC91c3Ivc2Jpbi9zb2NrZCkgYW5kIGFu b3RoZXIKCXNjcmlwdCBmb3IgdGhlIGNsaWVudCAoL3Vzci9iaW4vc29ja3NpZnkp LiBJbiBhZGRpdGlvbiwgdGhpcyBwYWNrYWdlIAoJd2lsbCBhbHNvIGFkZCAyIHNo YXJlZCBsaWJyYXJpZXMgYXMgYmVsb3csCgoJL3Vzci9saWIvbGliZHNvY2tzLnNv CgkvdXNyL2xpYi9saWJzb2Nrcy5zbwoJCglUaGUgL3Vzci9iaW4vc29ja3NpZnkg c2NyaXB0IHdpbGwgbG9hZCB0aGUgZHluYW1pYyBsaWJyYXJpZXMgbWVudGlvbmVk CglhYm92ZSB0byAic29ja3NpZnkiIGV4aXN0aW5nIGFwcGxpY2F0aW9ucyB0byBi ZWNvbWUgc29ja3MgY2xpZW50cy4KCglGb3IgdGhlIHNlcnZlciwgL2V0Yy9zb2Nr ZC5jb25mIHdpbGwgYmUgdXNlZCBhcyBhIGNvbmZpZ3VyYXRpb24gZmlsZSwKCWFu ZCBmb3IgdGhlIGNsaWVudCwgL2V0Yy9zb2Nrcy5jb25mIHdpbGwgYmUgdXNlZCBm b3IgY29uZmlndXJhdGlvbi4KCglUaGlzIHBhY2thZ2Ugd2lsbCBub3QgaW1wb3J0 IGFueSBpbnRlcmZhY2VzLCB0aGUgZXhwb3J0ZWQgaW50ZXJmYWNlcyAKCWNhbiBi ZSBzdW1tYXJpemVkIGluIHRoZSBmb2xsb3dpbmcgbWFubmVyLAoKCSArLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsgIAoJIHwgICB8IEludGVyZmFjZSBOYW1l ICAgICAgfCBDbGFzc2lmaWNhdGlvbiAgICAgICB8IENvbW1lbnRzICAgICAgICAg ICAgICAgICAgfAoJIHwtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tfAoJIHwg MSB8IGxpYmRzb2Nrcy5zbyAgICAgICAgfCBQcm9qZWN0IFByaXZhdGUJICB8IFNP Q0tTIGRhZW1vbiBsaWJyYXJ5ICAgICAgfAoJIHwgICB8LS0tLS0tLS0tLS0tLS0t LS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tfCAKCSB8IDIgfCBsaWJzb2Nrcy5zbyAgICAgICAgIHwgQ29tbWl0 dGVkIAkJICB8IFNPQ0tTIGxpYnJhcnkgICAgICAgICAgICAgfCAgCgkgfCAgIHwt LS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS18IAoJIHwgMyB8IHNvY2tzaWZ5ICAgICAg ICAgICAgfCBVbmNvbW1pdHRlZCAJICB8IFNPQ0tTIGNsaWVudCBzY3JpcHQgICAg ICAgfCAKCSB8ICAgfC0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLXwgCgkgfCA0IHwg c29ja2QgICAgICAgICAgICAgICB8IFVuY29tbWl0dGVkIAkgIHwgU09DS1Mgc2Vy dmVyIGRhZW1vbiAgICAgICB8ICAKCSB8ICAgfC0tLS0tLS0tLS0tLS0tLS0tLS0t LSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLXwgCgkgfCA1IHwgc29ja3MuY29uZiAgICAgICAgICB8IFVuY29tbWl0dGVk IAkgIHwgQ2xpZW50IGNvbmZpZ3VyYXRpb24gZmlsZSB8IAoJIHwgICB8LS0tLS0t LS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tfCAKCSB8IDYgfCBzb2NrZC5jb25mICAgICAgICAg IHwgVW5jb21taXR0ZWQgCSAgfCBTZXJ2ZXIgY29uZmlndXJhdGlvbiBmaWxlIHwg IAoJIHwgICB8LS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tfCAKCSB8IDcgfCBTVU5X bGlic29ja3MJICAgfCBQdWJsaWMvQ29tbWl0dGVkICAgICB8IENsaWVudCBwYWNr YWdlIAkgICAgICB8IAoJIHwgICB8LS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tfCAK CSB8IDggfCBTVU5XZGFudGV1CSAgIHwgUHVibGljL0NvbW1pdHRlZCAgICAgfCBT ZXJ2ZXIgcGFja2FnZSAoVXNlcikgICAgIHwKCSB8ICAgfC0tLS0tLS0tLS0tLS0t LS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLXwgCgkgfCA5IHwgU1VOV2RhbnRlcgkgICB8IFB1YmxpYy9Db21t aXR0ZWQgICAgIHwgU2VydmVyIHBhY2thZ2UgKFJvb3QpICAgICB8ICAKCSB8ICAg fC0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLXwgCgkgfDEwIHwgbmV0d29yay9zb2Nr cwkgICB8IFB1YmxpYy9Db21taXR0ZWQgICAgIHwgU01GIFNlcnZpY2UgbmFtZSAg ICAgICAgICB8ICAKCSB8ICAgfC0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLXwgCgkg fDExIHwgc29ja2QJICAgCSAgIHwgVW5jb21taXR0ZWQgICAgICAgICAgfCBQQU0g U2VydmljZW5hbWUgICAgICAgICAgIHwgIAoJICstLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tKyAgICAgICAgICAgICAgICAgICAKCiAgICAKICAgIDQuNi4gRG9j IEltcGFjdDoKCVRoaXMgaW50ZWdyYXRpb24gd2lsbCBjb3JyZWN0bHkgYWRkIG1h biBlbnRyaWVzLiBOb25lIG9mIHRoZSBleGlzdGluZyBtYW4KICAgICAgICBlbnRy aWVzIHdpbGwgYmUgdG91Y2hlZC4gVGhlIG5ldyBtYW4gZW50cmllcyBhcmUgYXMg YmVsb3csCgoJL3Vzci9tYW4vbWFuMW0vc29ja2QuMW0KCS91c3IvbWFuL21hbjEv c29ja3NpZnkuMQoJL3Vzci9tYW4vbWFuNC9zb2NrZC5jb25mLjQKCS91c3IvbWFu L21hbjQvc29ja3MuY29uZi40CiAKICAgIDQuNy4gQWRtaW4vQ29uZmlnIEltcGFj dDoKICAgCglUaGUgcGFja2FnZSB3aWxsIGFsc28gcHJvdmlkZSB0ZW1wbGF0ZSBv ZiBjb25maWd1cmF0aW9uIGZpbGVzCglmb3IgYm90aCBzZXJ2ZXIgYW5kIGNsaWVu dC4gVGhlIHRlbXBsYXRlcyBmb3IgdGhlc2UgY29uZmlndXJlYXRpb24KCWZpbGVz IGFyZSBhdHRhY2hlZC4KCgkvZXRjL3NvY2tkLmNvbmYKCS9ldGMvc29ja3MuY29u ZgoKICAgIDQuOC4gSEEgSW1wYWN0OgoJTi9BCiAgICAKICAgIDQuOS4gSTE4Ti9M MTBOIEltcGFjdDoKCU5vbmUuIFRoZSBlcnJvciBtZXNzYWdlcyBhcmUgbm90IGxv Y2FsaXplZC4KICAgIAogICAgNC4xMC4gUGFja2FnaW5nICYgRGVsaXZlcnk6CglC b3RoIHNlcnZlciBhbmQgY2xpZW50IHdpbGwgYmUgaW5zdGFsbGVkIHdpdGggZm9s bG93aW5nIHBhY2thZ2VzLgoKCVNVTldsaWJzb2NrcwlEYW50ZSAtIEEgU29ja3Mg Y2xpZW50IGltcGxlbWVudGF0aW9uCglTVU5XZGFudGVyCURhbnRlIC0gQSBTb2Nr cyBzZXJ2ZXIgaW1wbGVtZW50YXRpb24sIFJvb3QKCVNVTldkYW50ZXUJRGFudGUg LSBBIFNvY2tzIHNlcnZlciBpbXBsZW1lbnRhdGlvbiwgVXNlcgoKICAgIDQuMTEu IFNlY3VyaXR5IEltcGFjdDoKCglTb2NrcyBTZXJ2ZXIgYW5kIGNsaWVudCB3aWxs IGRlcGVuZCBvbiB0aGUgcG9ydCBjb25maWd1cmVkIGluIHRoZSByZXNwZWN0aXZl IAoJY29uZmlndXJhdGlvbiBmaWxlIGZvciBuZXR3b3JrIGNvbm5lY3Rpdml0eS4K CglUaGUgc2VydmVyIGNvbmZpZ3VyYXRpb24gZmlsZSBkZWZpbmVzIHR3byB2YXJp YWJsZXMgYXMsIHVzZXIucHJpdmlsZWdlZCBhbmQgCgl1c2VyLm5vdHByaXZpbGVn ZWQuIFRoZXNlIDIgdmFyaWFibGVzIGNhbiBoYXZlIGEgbGlzdCBvZiB1c2VyaWRz IHNlcGFyYXRlZCAKCWJ5IGNvbW1hLiBUaGUgc2VydmVyIGltcGxlbWVudGF0aW9u IGNhbGxzIHNldGV1aWQgZnVuY3Rpb24gdG8gc3dpdGNoIGJldHdlZW4gCglwcml2 aWxlZ2VkIGFuZCBub3Rwcml2aWxlZ2VkIHVzZXJzLiBVcG9uIHN0YXJ0LCB0aGUg c2VydmVyIHN3aXRjaGVzIHRoZSBlZmZlY3RpdmUgCglpZCBmcm9tIHRoZSB1c2Vy IHdobyBzdGFydGVkIHRoZSBiaW5hcnkgdG8gdGhlIHNwZWNpZmllZCB1c2VyLm5v dHByaXZpbGVnZWQuIAoJTGF0ZXIsIGZvciBhbGwgdGhlIHByaXZpbGVnZWQgb3Bl cmF0aW9ucyAoZS5nLiBQQU0gYXV0aGVudGljYXRpb24pLCAKCXRoZSBzZXJ2ZXIg c2V0cyB0aGUgZWZmZWN0aXZlIHVzZXIgSUQgZnJvbSB1c2VyLm5vdHByaXZpbGVn ZWQgdG8gc3BlY2lmaWVkCgl1c2VyLnByaXZpbGVnZWQgYnkgY2FsbGluZyBzZXRl dWlkIGZ1bmN0aW9uLiAKCglUaGUgYmVoYXZpb3IgYXMgZGVzY3JpYmVkIGFib3Zl IGlzIG5vdCBhIHJlY29tbWVuZGVkIHByYWN0aWNlIHdpdGggU29sYXJpcy4gSW5z dGVhZAoJb2Ygc3dpdGNoaW5nIGJldHdlZW4gdXNlciBJRHMgZm9yIHByaXZpbGVn ZWQgYW5kIG5vbi1wcml2aWxlZ2VkIG9wZXJhdGlvbnMsCglTb2xhcmlzIHJlY29t bWVuZHMgdG8gYWNxdWlyZSBhbmQgcmVsZWFzZSBzcGVjaWZpYyBwcml2aWxlZ2Vz IGZvciBzdWNoIHByaXZpbGVnZWQgCglhY3Rpb25zIHdoaWNoIHByb3ZpZGUgYmV0 dGVyIGFuZCBmaW5lIGdyYWluZWQgY29udHJvbC4KCglIb3dldmVyLCB0aGUgZGFu dGUgc2VydmVyIGltcGxlbWVudGF0aW9uIGRvZXMgbm90IHVzZSB0aGUgcHJpdmls ZWdlIG1lY2hhbmlzbSAKCWFuZCBkZXBlbmRzIG9uIHRoZSAyIHVzZXJzIGRlZmlu ZWQgaW4gdGhlIGNvbmZpZ3VyYXRpb24gZmlsZS4KCQoJVGhlIGRlZmF1bHQvc2Ft cGxlIGNvbmZpZ3VyYXRpb24gZmlsZSB3aWxsIGhhdmUgdXNlci5ub3Rwcml2aWxl Z2VkIGFzICdkYWVtb24nIAoJYW5kIHRoZSB1c2VyLnByaXZpbGVnZWQgd2lsbCBi ZSBzZXQgdG8gJ3Jvb3QnLiBUaGUgcmVhc29uIHdoeSB1c2VyLnByaXZpbGVnZWQK CW5lZWQgdG8gYmUgcm9vdCBpcyBiZWNhdXNlIHBhbV9hdXRoZW50aWNhdGUoM3Bh bSkgcmVxdWlyZXMgYWxsIHByaXZpbGVnZXMgYW5kCgl1c2VyIElEIGFzIDAuCgoJ QnkgZGVmYXVsdCwgRGFudGUgc2VydmVyIHdpbGwgdXNlIHBvcnQgMTA4MCwgdGhl IHBvcnQgY2FuIGJlIGNvbmZpZ3VyZWQgaW4KCS9ldGMvc29ja2QuY29uZiBmaWxl LiBQbGVhc2Ugbm90ZSB0aGF0IGlmIGEgcmVzZXJ2ZWQgcG9ydCBpcyBjb25maWd1 cmVkIHRoZW4KCXRoZSBkYW50ZSBzZXJ2ZXIgd2lsbCBiaW5kIHRvIGl0IHN1Y2Nl c3NmdWxseSwgYXMgdGhlIHVzZXIucHJpdmlsZWdlZCBpcyAKCXNldCB0byAncm9v dCcuCgogICAgNC4xMS4xIFBBTSBBdXRoZW50aWNhdGlvbgogICAgCglEYW50ZSBz ZXJ2ZXIgY29uZmlybXMgdG8gdGhlIFBBTSBwb2xpY3kgc3BlY2lmaWVkIGZvciB0 aGUgVXNlciBJZGVudGlmaWNhdGlvbiBhbmQKCUF1dGhlbnRpY2F0aW9uLiBEdXJp bmcgYXV0aGVudGljYXRpb24sIHRoZSBzZXJ2ZXIgbWFrZXMgY2FsbHMgdG8gZm9s bG93aW5nIGZ1bmN0aW9ucwoJaW4gb3JkZXIsCgkJcGFtX3N0YXJ0KCkKCQlwYW1f c2V0X2l0ZW0oKQoJCXBhbV9hdXRoZW50aWNhdGUoKQoJCXBhbV9hY2N0X21nbXQo KQoJCXBhbV9lbmQoKQoKCVBsZWFzZSBub3RlIHRoYXQgYmVmb3JlIHN0YXJ0aW5n IHRoZSBwYW0gYXV0aGVudGljYXRpb24sIGRhbnRlIHNlcnZlciBjYWxscyBzZXRl dWlkKCkKCXRvIHN3aXRjaCB0byB0aGUgc3BlY2lmaWVkIHByaXZpbGVnZWQgdXNl ci4gSW4gU29sYXJpcywgUEFNIHJlcXVpcmVzIGFsbCBwcml2aWxlZ2VzIAoJYW5k IHVzZXIgSUQgMCBhbmQgaGVuY2UgaXQgaXMgbmVjZXNzYXJ5IHRoYXQgdXNlci5w cml2aWxlZ2VkIHNob3VsZCBiZSBzZXQgdG8gJ3Jvb3QnCglpbiB0aGUgL2V0Yy9z b2NrZC5jb25mIGZpbGUuCgogICAgNC4xMi4gRGVwZW5kZW5jaWVzOgoKCVRoZSBz b2NrcyBzZXJ2ZXIgbWFpbmx5IGRlcGVuZHMgb24gdGhlIGF2YWlsYWJsZSBzdXBw b3J0IGZvciBQQU0uCglUaGUgZGV0YWlscyBvZiBkZXBlbmRlbmNpZXMgYXJlIGFz IGJlbG93LAoKCWJhc2gtMy4wMCMgbGRkIGxpYnNvY2tzLnNvCiAgICAgICAgbGli cGFtLnNvLjEgPT4gICAvbGliL2xpYnBhbS5zby4xCiAgICAgICAgbGlic29ja2V0 LnNvLjEgPT4gICAgICAgIC9saWIvbGlic29ja2V0LnNvLjEKICAgICAgICBsaWJu c2wuc28uMSA9PiAgIC9saWIvbGlibnNsLnNvLjEKICAgICAgICBsaWJyZXNvbHYu c28uMiA9PiAgICAgICAgL2xpYi9saWJyZXNvbHYuc28uMgogICAgICAgIGxpYmMu c28uMSA9PiAgICAgL2xpYi9saWJjLnNvLjEKICAgICAgICBsaWJtcC5zby4yID0+ ICAgIC9saWIvbGlibXAuc28uMgogICAgICAgIGxpYm1kLnNvLjEgPT4gICAgL2xp Yi9saWJtZC5zby4xCiAgICAgICAgbGlic2NmLnNvLjEgPT4gICAvbGliL2xpYnNj Zi5zby4xCiAgICAgICAgbGlidXV0aWwuc28uMSA9PiAgICAgICAgIC9saWIvbGli dXV0aWwuc28uMQogICAgICAgIGxpYmdlbi5zby4xID0+ICAgL2xpYi9saWJnZW4u c28uMQogICAgICAgIGxpYm0uc28uMiA9PiAgICAgL2xpYi9saWJtLnNvLjIKCglU aGUgb3V0cHV0IG9mIGxkZCBjb21tYW5kIGZvciBsaWJkc29ja3Muc28gc2hvd3Mg ZXhhY3RseSB0aGUgc2FtZSBvdXRwdXQKCWFzIGFib3ZlLgoKCWJhc2gtMy4wMCMg bGRkIC91c3Ivc2Jpbi9zb2NrZCAKICAgICAgICBsaWJ3cmFwLnNvLjEgPT4gIC91 c3IvbGliL2xpYndyYXAuc28uMQogICAgICAgIGxpYnBhbS5zby4xID0+ICAgL2xp Yi9saWJwYW0uc28uMQogICAgICAgIGxpYnNvY2tldC5zby4xID0+ICAgICAgICAv bGliL2xpYnNvY2tldC5zby4xCiAgICAgICAgbGlibnNsLnNvLjEgPT4gICAvbGli L2xpYm5zbC5zby4xCiAgICAgICAgbGlicmVzb2x2LnNvLjIgPT4gICAgICAgIC9s aWIvbGlicmVzb2x2LnNvLjIKICAgICAgICBsaWJjLnNvLjEgPT4gICAgIC9saWIv bGliYy5zby4xCiAgICAgICAgbGlibXAuc28uMiA9PiAgICAvbGliL2xpYm1wLnNv LjIKICAgICAgICBsaWJtZC5zby4xID0+ICAgIC9saWIvbGlibWQuc28uMQogICAg ICAgIGxpYnNjZi5zby4xID0+ICAgL2xpYi9saWJzY2Yuc28uMQogICAgICAgIGxp YnV1dGlsLnNvLjEgPT4gICAgICAgICAvbGliL2xpYnV1dGlsLnNvLjEKICAgICAg ICBsaWJnZW4uc28uMSA9PiAgIC9saWIvbGliZ2VuLnNvLjEKICAgICAgICBsaWJt LnNvLjIgPT4gICAgIC9saWIvbGlibS5zby4yCgoJVGhlIFNNRiBzZXJ2aWNlIGZv ciBEYW50ZSBzZXJ2ZXIgZG9lcyBub3QgZGVwZW5kIG9uIGFueSBvdGhlciBzcGVj aWZpYyAKCXNlcnZpY2UuCgo1LiBSZWZlcmVuY2UgRG9jdW1lbnRzOgoKCWh0dHA6 Ly93d3cuaW5ldC5uby9kYW50ZS8KCjYuIFJlc291cmNlcyBhbmQgU2NoZWR1bGU6 CiAgIDYuMS4gUHJvamVjdGVkIEF2YWlsYWJpbGl0eToKCglJbnRlZ3JhdGlvbiB0 YXJnZXRlZCBmb3IgSW5kaWFuYSByZWxlYXNlLgoKICAgNi4yLiBDb3N0IG9mIEVm Zm9ydDoKCglNaW5pbXVtLiBPbmUgcmVzb3VyY2UgZm9yIGludGVncmF0aW9uIGlu IFNGVyBjb25zb2xpZGF0aW9uLgkKCiAgIDYuMy4gQ29zdCBvZiBDYXBpdGFsIFJl c291cmNlczoKCU5vbmUKCiAgIDYuNC4gUHJvZHVjdCBBcHByb3ZhbCBDb21taXR0 ZWUgcmVxdWVzdGVkIGluZm9ybWF0aW9uOgogICAJNi40LjEuIENvbnNvbGlkYXRp b24gb3IgQ29tcG9uZW50IE5hbWU6CgkJU0ZXCgoJNi40LjMuIFR5cGUgb2YgQ1BU IFJldmlldyBhbmQgQXBwcm92YWwgZXhwZWN0ZWQ6CgkJRkFTVFRSQUNLCgogICAg ICAgIDYuNC40LiBQcm9qZWN0IEJvdW5kYXJ5IENvbmRpdGlvbnM6CgkJTm9uZQoK CTYuNC41LiBJcyB0aGlzIGEgbmVjZXNzYXJ5IHByb2plY3QgZm9yIE9FTSBhZ3Jl ZW1lbnRzOgoJCU5vCgoJNi40LjYuIE5vdGVzOgoKCTYuNC43LiBUYXJnZXQgUlRJ IERhdGUvUmVsZWFzZToKCQlJbmRpYW5hIFJlbGVhc2UKCgk2LjQuOC4gVGFyZ2V0 IENvZGUgRGVzaWduIFJldmlldyBEYXRlOgoJNi40LjkuIFVwZGF0ZSBhcHByb3Zh bCBhZGRpdGlvbjoKCiAgIDYuNS4gQVJDIHJldmlldyB0eXBlOgoJCUZhc3RUcmFj awoKICAgNi42LiBBUkMgRXhwb3N1cmU6CgkJT1BFTgoKICAgICAgIDYuNi4xLiBS YXRpb25hbGU6Cgo3LiBQcm90b3R5cGUgQXZhaWxhYmlsaXR5OgogICA3LjEuIFBy b3RvdHlwZSBBdmFpbGFiaWxpdHk6CglOL0EKCiAgIDcuMi4gUHJvdG90eXBlIENv c3Q6CglOL0EKCiB8LS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tfCAKCSB8IDUgfCBz b2Nrcy5jb25mICAgICAgICAgIHwgVW5jb21taXR0ZWQgCSAgfCBDbGllbnQgY29u ZmlndXJhdGlvbiBmaWxlIG1hdGVyaWFsL3NvY2tkLmNvbmYAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwNjAwADA0MDcxNTYAMDAwMDAxMgAwMDAw MDAxNjcwNAAxMTExNTQ0NTI3MAAwMDE1MTM1ADAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdXN0YXIAMDBtbjEzMzc2 NgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHN0YWZmAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAMDAwMDE0NgAwMDAwMDAzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA IyAkSWQ6IHNvY2tkLmNvbmYsdiAxLjQzIDIwMDUvMTIvMjYgMTY6MzU6MjYgbWlj aGFlbHMgRXhwICQKIwojIEEgc2FtcGxlIHNvY2tkLmNvbmYKIwojCiMgVGhlIGNv bmZpZ2ZpbGUgaXMgZGl2aWRlZCBpbnRvIHRocmVlIHBhcnRzOyAKIyAgICAxKSBz ZXJ2ZXJzZXR0aW5ncwojICAgIDIpIHJ1bGVzCiMgICAgMykgcm91dGVzCiMKIyBU aGUgcmVjb21tZW5kZWQgb3JkZXIgaXM6CiMgICBTZXJ2ZXJzZXR0aW5nczoKIyAg ICAgICAgICAgICAgIGxvZ291dHB1dAojICAgICAgICAgICAgICAgaW50ZXJuYWwK IyAgICAgICAgICAgICAgIGV4dGVybmFsCiMgICAgICAgICAgICAgICBtZXRob2QK IyAgICAgICAgICAgICAgIGNsaWVudG1ldGhvZAojICAgICAgICAgICAgICAgdXNl cnMKIyAgICAgICAgICAgICAgIGNvbXBhdGliaWxpdHkKIyAgICAgICAgICAgICAg IGV4dGVuc2lvbgojICAgICAgICAgICAgICAgY29ubmVjdHRpbWVvdXQKIyAgICAg ICAgICAgICAgIGlvdGltZW91dAojCQlzcmNob3N0CiMKIyAgUnVsZXM6CiMJY2xp ZW50IGJsb2NrL3Bhc3MKIwkJZnJvbSB0bwojCQlsaWJ3cmFwCiMJCWxvZwojCiMg ICAgIGJsb2NrL3Bhc3MKIwkJZnJvbSB0bwojCQltZXRob2QKIwkJY29tbWFuZAoj CQlsaWJ3cmFwCiMJCWxvZwojCQlwcm90b2NvbAojCQlwcm94eXByb3RvY29sCiMK IyAgUm91dGVzOiAKCiMgdGhlIHNlcnZlciB3aWxsIGxvZyBib3RoIHZpYSBzeXNs b2csIHRvIHN0ZG91dCBhbmQgdG8gL3Zhci9sb2cvbG90c29mbG9ncwojbG9nb3V0 cHV0OiBzeXNsb2cgc3Rkb3V0IC92YXIvbG9nL2xvdHNvZmxvZ3MKbG9nb3V0cHV0 OiBzdGRlcnIKCiMgVGhlIHNlcnZlciB3aWxsIGJpbmQgdG8gdGhlIGFkZHJlc3Mg MTAuMS4xLjEsIHBvcnQgMTA4MCBhbmQgd2lsbCBvbmx5CiMgYWNjZXB0IGNvbm5l Y3Rpb25zIGdvaW5nIHRvIHRoYXQgYWRkcmVzcy4KI2ludGVybmFsOiAxMC4xLjEu MSBwb3J0ID0gMTA4MAojIEFsdGVybmF0aXZlbHksIHRoZSBpbnRlcmZhY2UgbmFt ZSBjYW4gYmUgdXNlZCBpbnN0ZWFkIG9mIHRoZSBhZGRyZXNzLgojaW50ZXJuYWw6 IGV0aDAgcG9ydCA9IDEwODAKCiMgYWxsIG91dGdvaW5nIGNvbm5lY3Rpb25zIGZy b20gdGhlIHNlcnZlciB3aWxsIHVzZSB0aGUgSVAgYWRkcmVzcwojIDE5NS4xNjgu MS4xCiNleHRlcm5hbDogMTkyLjE2OC4xLjEKCiMgbGlzdCBvdmVyIGFjY2VwdGFi bGUgbWV0aG9kcywgb3JkZXIgb2YgcHJlZmVyZW5jZS4KIyBBIG1ldGhvZCBub3Qg c2V0IGhlcmUgd2lsbCBuZXZlciBiZSBzZWxlY3RlZC4KIwojIElmIHRoZSBtZXRo b2QgZmllbGQgaXMgbm90IHNldCBpbiBhIHJ1bGUsIHRoZSBnbG9iYWwKIyBtZXRo b2QgaXMgZmlsbGVkIGluIGZvciB0aGF0IHJ1bGUuCiMKCiMgbWV0aG9kcyBmb3Ig c29ja3MtcnVsZXMuCiNtZXRob2Q6IHVzZXJuYW1lIG5vbmUgI3JmYzkzMQoKIyBt ZXRob2RzIGZvciBjbGllbnQtcnVsZXMuCiNjbGllbnRtZXRob2Q6IG5vbmUKCiNv ciBpZiB5b3Ugd2FudCB0byBhbGxvdyByZmM5MzEgKGlkZW50KSB0b28KI21ldGhv ZDogdXNlcm5hbWUgcmZjOTMxIG5vbmUKCiNvciBmb3IgUEFNIGF1dGhlbnRpZmlj YXRpb24KI21ldGhvZDogcGFtCgojCiMgQW4gaW1wb3J0YW50IHNlY3Rpb24sIHBh eSBhdHRlbnRpb24uCiMKCiMgd2hlbiBkb2luZyBzb21ldGhpbmcgdGhhdCBjYW4g cmVxdWlyZSBwcml2aWxlZ2UsIGl0IHdpbGwgdXNlIHRoZQojIHVzZXJpZCAic29j a2QiLgojdXNlci5wcml2aWxlZ2VkOiBzb2NrZAoKIyB3aGVuIHJ1bm5pbmcgYXMg dXN1YWwsIGl0IHdpbGwgdXNlIHRoZSB1bnByaXZpbGVnZWQgdXNlcmlkIG9mICJz b2NrZCIuCiN1c2VyLm5vdHByaXZpbGVnZWQ6IHNvY2tkCgojIElmIHlvdSBjb21w aWxlZCB3aXRoIGxpYndyYXAgc3VwcG9ydCwgd2hhdCB1c2VyaWQgc2hvdWxkIGl0 IHVzZQojIHdoZW4gZXhlY3V0aW5nIHlvdXIgbGlid3JhcCBjb21tYW5kcz8gICJs aWJ3cmFwIi4KI3VzZXIubGlid3JhcDogbGlid3JhcAoKCiMKIyBzb21lIG9wdGlv bnMgdG8gaGVscCBjbGllbnRzIHdpdGggY29tcGF0aWJpbGl0eToKIwoKIyB3aGVu IGEgY2xpZW50IGNvbm5lY3Rpb24gY29tZXMgaW4gdGhlIHNvY2tzc2VydmVyIHdp bGwgdHJ5IHRvIHVzZQojIHRoZSBzYW1lIHBvcnQgYXMgdGhlIGNsaWVudCBpcyB1 c2luZywgd2hlbiB0aGUgc29ja3NzZXJ2ZXIKIyBnb2VzIG91dCBvbiB0aGUgY2xp ZW50cyBiZWhhbGYgKGV4dGVybmFsOiBJUCBhZGRyZXNzKS4KIyBJZiB0aGlzIG9w dGlvbiBpcyBzZXQsIERhbnRlIHdpbGwgdHJ5IHRvIGRvIGl0IGZvciByZXNlcnZl ZCBwb3J0cyBhc3dlbGwuCiMgVGhpcyB3aWxsIHVzdWFsbHkgcmVxdWlyZSB1c2Vy LnByaXZpbGVnZWQgdG8gYmUgc2V0IHRvICJyb290Ii4KI2NvbXBhdGliaWxpdHk6 IHNhbWVwb3J0CgojIElmIHlvdSBhcmUgdXNpbmcgdGhlIGJpbmQgZXh0ZW5zaW9u IGFuZCBoYXZlIHRyb3VibGUgcnVubmluZyBzZXJ2ZXJzCiMgdmlhIHRoZSBzZXJ2 ZXIsIHlvdSBtaWdodCB0cnkgc2V0dGluZyB0aGlzLiAgVGhlIGNvbnNlcXVlbmNl cyBvZiBpdAojIGFyZSB1bmtub3duLgojY29tcGF0aWJpbGl0eTogcmV1c2VhZGRy CgojCiMgVGhlIERhbnRlIHNlcnZlciBzdXBwb3J0cyBzb21lIGV4dGVuc2lvbnMg dG8gdGhlIHNvY2tzIHByb3RvY29sLgojIFRoZXNlIHJlcXVpcmUgdGhhdCB0aGUg c29ja3MgY2xpZW50IGltcGxlbWVudHMgdGhlIHNhbWUgZXh0ZW5zaW9uIGFuZAoj IGNhbiBiZSBlbmFibGVkIHVzaW5nIHRoZSAiZXh0ZW5zaW9uIiBrZXl3b3JkLgoj CiMgZW5hYmxlIHRoZSBiaW5kIGV4dGVuc2lvbi4KI2V4dGVuc2lvbjogYmluZAoK CiMKIwojIG1pc2Mgb3B0aW9ucy4KIwoKIyBob3cgbWFueSBzZWNvbmRzIGNhbiBw YXNzIGZyb20gd2hlbiBhIGNsaWVudCBjb25uZWN0cyB0aWwgaXQgaGFzCiMgc2Vu dCB1cyBpdCdzIHJlcXVlc3Q/ICBBZGp1c3QgYWNjb3JkaW5nIHRvIHlvdXIgbmV0 d29yayBwZXJmb3JtYW5jZQojIGFuZCBtZXRob2RzIHN1cHBvcnRlZC4KI2Nvbm5l Y3R0aW1lb3V0OiAzMCAgICMgb24gYSBsYW4sIHRoaXMgc2hvdWxkIGJlIGVub3Vn aCBpZiBtZXRob2QgaXMgIm5vbmUiLgoKIyBob3cgbWFueSBzZWNvbmRzIGNhbiB0 aGUgY2xpZW50IGFuZCBpdCdzIHBlZXIgaWRsZSB3aXRob3V0IHNlbmRpbmcKIyBh bnkgZGF0YSBiZWZvcmUgd2UgZHVtcCBpdD8gIFVubGVzcyB5b3UgZGlzYWJsZSB0 Y3Aga2VlcC1hbGl2ZSBmb3IKIyBzb21lIHJlYXNvbiwgaXQncyBwcm9iYWJseSBi ZXN0IHRvIHNldCB0aGlzIHRvIDAsIHdoaWNoIGlzCiMgImZvcmV2ZXIiLgojaW90 aW1lb3V0OiAwICMgb3IgcGVyaGFwcyA4NjQwMCwgZm9yIGEgZGF5LgoKIyBkbyB5 b3Ugd2FudCB0byBhY2NlcHQgY29ubmVjdGlvbnMgZnJvbSBhZGRyZXNzZXMgd2l0 aG91dAojIGRucyBpbmZvPyAgd2hhdCBhYm91dCBhZGRyZXNzZXMgaGF2aW5nIGEg bWlzbWF0Y2ggaW4gZG5zaW5mbz8KI3NyY2hvc3Q6IG5vdW5rbm93biBub21pc21h dGNoCgojCiMgVGhlIGFjdHVhbCBydWxlcy4gIFRoZXJlIGFyZSB0d28ga2luZHMg YW5kIHRoZXkgd29yayBhdCBkaWZmZXJlbnQgbGV2ZWxzLgojCiMgVGhlIHJ1bGVz IHByZWZpeGVkIHdpdGggImNsaWVudCIgYXJlIGNoZWNrZWQgZmlyc3QgYW5kIHNh eSB3aG8gaXMgYWxsb3dlZAojIGFuZCB3aG8gaXMgbm90IGFsbG93ZWQgdG8gc3Bl YWsvY29ubmVjdCB0byB0aGUgc2VydmVyLiAgSS5lIHRoZQojIGlwIHJhbmdlIGNv bnRhaW5pbmcgcG9zc2libHkgdmFsaWQgY2xpZW50cy4KIyBJdCBpcyBlc3BlY2lh bGx5IGltcG9ydGFudCB0aGF0IHRoZXNlIG9ubHkgdXNlIElQIGFkZHJlc3Nlcywg bm90IGhvc3RuYW1lcywKIyBmb3Igc2VjdXJpdHkgcmVhc29ucy4KIwojIFRoZSBy dWxlcyB0aGF0IGRvIG5vdCBoYXZlIGEgImNsaWVudCIgcHJlZml4IGFyZSBjaGVj a2VkIGxhdGVyLCB3aGVuIHRoZQojIGNsaWVudCBoYXMgc2VudCBpdHMgcmVxdWVz dCBhbmQgYXJlIHVzZWQgdG8gZXZhbHVhdGUgdGhlIGFjdHVhbAojIHJlcXVlc3Qu CiMKIyBUaGUgInRvOiIgaW4gdGhlICJjbGllbnQiIGNvbnRleHQgZ2l2ZXMgdGhl IGFkZHJlc3MgdGhlIGNvbm5lY3Rpb24KIyBpcyBhY2NlcHRlZCBvbiwgaS5lIHRo ZSBhZGRyZXNzIHRoZSBzb2Nrc3NlcnZlciBpcyBsaXN0ZW5pbmcgb24sIG9yCiMg anVzdCAiMC4wLjAuMC8wIiBmb3IgYW55IGFkZHJlc3MgdGhlIHNlcnZlciBpcyBs aXN0ZW5pbmcgb24uCiMKIyBUaGUgInRvOiIgaW4gdGhlIG5vbi0iY2xpZW50IiBj b250ZXh0IGdpdmVzIHRoZSBkZXN0aW5hdGlvbiBvZiB0aGUgY2xpZW50cwojIHNv Y2tzcmVxdWVzdC4KIwojICJmcm9tOiIgaXMgdGhlIHNvdXJjZSBhZGRyZXNzIGlu IGJvdGggY29udGV4dHMuCiMKCgojIHRoZSAiY2xpZW50IiBydWxlcy4gIEFsbCBv dXIgY2xpZW50cyBjb21lIGZyb20gdGhlIG5ldCAxMC4wLjAuMC84LgojCgojIEFs bG93IG91ciBjbGllbnRzLCBhbHNvIHByb3ZpZGVzIGFuIGV4YW1wbGUgb2YgdGhl IHBvcnQgcmFuZ2UgY29tbWFuZC4KI2NsaWVudCBwYXNzIHsKIwlmcm9tOiAxMC4w LjAuMC84IHBvcnQgMS02NTUzNSB0bzogMC4wLjAuMC8wCiMJbWV0aG9kOiByZmM5 MzEgIyBtYXRjaCBhbGwgaWRlbnRlZCB1c2VycyB0aGF0IGFsc28gYXJlIGluIHBh c3N3b3JkZmlsZQojfQoKIyBUaGlzIGlzIGlkZW50aWNhbCB0byBhYm92ZSwgYnV0 IGFsbG93cyBjbGllbnRzIHdpdGhvdXQgYSByZmM5MzEgKGlkZW50KQojIHRvby4g IEluIHByYWN0aXNlIHRoaXMgbWVhbnMgdGhlIHNvY2tzc2VydmVyIHdpbGwgdHJ5 IHRvIGdldCBhIHJmYzkzMQojIHJlcGx5IGZpcnN0ICh0aGUgYWJvdmUgcnVsZSks IGlmIHRoYXQgZmFpbHMsIGl0IHRyaWVzIHRoaXMgcnVsZS4KI2NsaWVudCBwYXNz IHsKIwlmcm9tOiAxMC4wLjAuMC84IHBvcnQgMS02NTUzNSB0bzogMC4wLjAuMC8w CiN9CgoKIyBkcm9wIGV2ZXJ5b25lIGVsc2UgYXMgc29vbiBhcyB3ZSBjYW4gYW5k IGxvZyB0aGUgY29ubmVjdCwgdGhleSBhcmUgbm90CiMgb24gb3VyIG5ldCBhbmQg aGF2ZSBubyBidXNpbmVzcyBjb25uZWN0aW5nIHRvIHVzLiAgVGhpcyBpcyB0aGUg ZGVmYXVsdAojIGJ1dCBpZiB5b3UgZ2l2ZSB0aGUgcnVsZSB5b3Vyc2VsZiwgeW91 IGNhbiBzcGVjaWZ5IGRldGFpbHMuCiNjbGllbnQgYmxvY2sgewojCWZyb206IDAu MC4wLjAvMCB0bzogMC4wLjAuMC8wCiMJbG9nOiBjb25uZWN0IGVycm9yCiN9CgoK IyB0aGUgcnVsZXMgY29udHJvbGxpbmcgd2hhdCBjbGllbnRzIGFyZSBhbGxvd2Vk IHdoYXQgcmVxdWVzdHMKIwoKIyB5b3UgcHJvYmFibHkgZG9uJ3Qgd2FudCBwZW9w bGUgY29ubmVjdGluZyB0byBsb29wYmFjayBhZGRyZXNzZXMsCiMgd2hvIGtub3dz IHdoYXQgY291bGQgaGFwcGVuIHRoZW4uCiNibG9jayB7CiMJZnJvbTogMC4wLjAu MC8wIHRvOiAxMjcuMC4wLjAvOAojCWxvZzogY29ubmVjdCBlcnJvcgojfQoKIyB0 aGUgcGVvcGxlIGF0IHRoZSAxNzIuMTYuMC4wLzEyIGFyZSBiYWQsIG5vIG9uZSBz aG91bGQgdGFsayB0byB0aGVtLgojIGxvZyB0aGUgY29ubmVjdCByZXF1ZXN0IGFu ZCBhbHNvIHByb3ZpZGUgYW4gZXhhbXBsZSBvbiBob3cgdG8KIyBpbnRlcmFjdCB3 aXRoIGxpYndyYXAuCiNibG9jayB7CiMJZnJvbTogMC4wLjAuMC8wIHRvOiAxNzIu MTYuMC4wLzEyCiMJbGlid3JhcDogc3Bhd24gZmluZ2VyIEAlYQojCWxvZzogY29u bmVjdCBlcnJvcgojfQoKIyB1bmxlc3MgeW91IG5lZWQgaXQsIHlvdSBjb3VsZCBi bG9jayBhbnkgYmluZCByZXF1ZXN0cy4KI2Jsb2NrIHsKIwlmcm9tOiAwLjAuMC4w LzAgdG86IDAuMC4wLjAvMAojCWNvbW1hbmQ6IGJpbmQKIwlsb2c6IGNvbm5lY3Qg ZXJyb3IKI30KCiMgb3IgeW91IG1pZ2h0IHdhbnQgdG8gYWxsb3cgaXQsIGZvciBp bnN0YW5jZSAiYWN0aXZlIiBmdHAgdXNlcyBpdC4KIyBOb3RlIHRoYXQgYSAiYmlu ZHJlcGx5IiBjb21tYW5kIG11c3QgYWxzbyBiZSBhbGxvd2VkLCBpdAojIHNob3Vs ZCB1c3VhbGx5IGJ5IGZyb20gIjAuMC4wLjAvMCIsIGkuZSBpZiBhIGNsaWVudCBv ZiB5b3VycwojIGhhcyBwZXJtaXNzaW9uIHRvIGJpbmQsIGl0IHdpbGwgYWxzbyBo YXZlIHBlcm1pc3Npb24gdG8gYWNjZXB0CiMgdGhlIHJlcGx5IGZyb20gYW55d2hl cmUuCiNwYXNzIHsKIwlmcm9tOiAxMC4wLjAuMC84IHRvOiAwLjAuMC4wLzAKIwlj b21tYW5kOiBiaW5kCiMJbG9nOiBjb25uZWN0IGVycm9yCiN9CgojIHNvbWUgY29u bmVjdGlvbnMgZXhwZWN0IHNvbWUgc29ydCBvZiAicmVwbHkiLCB0aGlzIG1pZ2h0 IGJlCiMgdGhlIHJlcGx5IHRvIGEgYmluZCByZXF1ZXN0IG9yIGl0IG1heSBiZSB0 aGUgcmVwbHkgdG8gYQojIHVkcHBhY2tldCwgc2luY2UgdWRwIGlzIHBhY2tldGJh c2VkLgojIE5vdGUgdGhhdCBub3RoaW5nIGlzIGRvbmUgdG8gdmVyaWZ5IHRoYXQg aXQncyBhICJnZW51aW5lIiByZXBseSwKIyB0aGF0IGlzIGluIGdlbmVyYWwgbm90 IHBvc3NpYmxlIGFueXdheS4gIFRoZSBiZWxvdyB3aWxsIGFsbG93CiMgYWxsICJy ZXBsaWVzIiBpbiB0byB5b3VyIGNsaWVudHMgYXQgdGhlIDEwLjAuMC4wLzggbmV0 LgojcGFzcyB7CiMJZnJvbTogMC4wLjAuMC8wIHRvOiAxMC4wLjAuMC84CiMJY29t bWFuZDogYmluZHJlcGx5IHVkcHJlcGx5CiMJbG9nOiBjb25uZWN0IGVycm9yCiN9 CgoKIyBwYXNzIGFueSBodHRwIGNvbm5lY3RzIHRvIHRoZSBleGFtcGxlLmNvbSBk b21haW4gaWYgdGhleQojIGF1dGhlbnRpY2F0ZSB3aXRoIHVzZXJuYW1lLgojIFRo aXMgbWF0Y2hlcyAiZXhhbXBsZS5jb20iIGl0c2VsZiBhbmQgZXZlcnl0aGluZyBl bmRpbmcgaW4gIi5leGFtcGxlLmNvbSIuCiNwYXNzIHsKIwlmcm9tOiAxMC4wLjAu MC84IHRvOiAuZXhhbXBsZS5jb20gcG9ydCA9IGh0dHAKIwlsb2c6IGNvbm5lY3Qg ZXJyb3IKIwltZXRob2Q6IHVzZXJuYW1lCiN9CgoKCgojIGJsb2NrIGFueSBvdGhl ciBodHRwIGNvbm5lY3RzIHRvIHRoZSBleGFtcGxlLmNvbSBkb21haW4uCiNibG9j ayB7CiMJZnJvbTogMC4wLjAuMC8wIHRvOiAuZXhhbXBsZS5jb20gcG9ydCA9IGh0 dHAKIwlsb2c6IGNvbm5lY3QgZXJyb3IKI30KCiMgZXZlcnlvbmUgZnJvbSBvdXIg aW50ZXJuYWwgbmV0d29yaywgMTAuMC4wLjAvOCBpcyBhbGxvd2VkIHRvIHVzZQoj IHRjcCBhbmQgdWRwIGZvciBldmVyeXRoaW5nIGVsc2UuCiNwYXNzIHsKIwlmcm9t OiAxMC4wLjAuMC84IHRvOiAwLjAuMC4wLzAKIwlwcm90b2NvbDogdGNwIHVkcAoj fQoKIyBsYXN0IGxpbmUsIGJsb2NrIGV2ZXJ5b25lIGVsc2UuICBUaGlzIGlzIHRo ZSBkZWZhdWx0IGJ1dCBpZiB5b3UgcHJvdmlkZQojIG9uZSAgeW91cnNlbGYgeW91 IGNhbiBzcGVjaWZ5IHlvdXIgb3duIGxvZ2dpbmcvYWN0aW9ucwojYmxvY2sgewoj CWZyb206IDAuMC4wLjAvMCB0bzogMC4wLjAuMC8wCiMJbG9nOiBjb25uZWN0IGVy cm9yCiN9CgojIHJvdXRlIGFsbCBodHRwIGNvbm5lY3RzIHZpYSBhbiB1cHN0cmVh bSBzb2NrcyBzZXJ2ZXIsIGFrYSAic2VydmVyLWNoYWluaW5nIi4KI3JvdXRlIHsK IyBmcm9tOiAxMC4wLjAuMC84IHRvOiAwLjAuMC4wLzAgcG9ydCA9IGh0dHAgdmlh OiBzb2Nrcy5leGFtcGxlLm5ldCBwb3J0ID0gc29ja3MKI30KAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA bWF0ZXJpYWwvc29ja3MuY29uZgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAADAwMDA2MDAAMDQwNzE1NgAwMDAwMDEyADAwMDAwMDEwMjUzADExMTE1NDQ1 MjcwADAwMTUxNDUAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAB1c3RhcgAwMG1uMTMzNzY2AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAc3RhZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwMTQ2 ADAwMDAwMDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjICRJZDogc29ja3MuY29u Zix2IDEuMjggMjAwMS8xMi8xMiAxMzo1Njo0MiBrYXJscyBFeHAgJAojCiMgQSBz YW1wbGUgc29ja3MuY29uZgoKIyBUaGUgY29uZmlnZmlsZSBpcyBkaXZpZGVkIGlu dG8gdHdvIHBhcnRzOyBmaXJzdCBtaXNjLiBzZXR0aW5ncywKIyB0aGVuIHRoZSBy b3V0ZXMuICBPYmplY3RzIGluICdbXScgYXJlIG9wdGlvbmFsLgojCiMKIyByZWNv bW1lbmRlZCBvcmRlciBpczoKIwlbZGVidWddCiMJW2xvZ291dHB1dF0KIwlbcmVz b2x2ZXByb3RvY29sXQojCiMJcm91dGVzOgojCQlmcm9tIHRvIHZpYQojCQlbY29t bWFuZF0KIwkJW2V4dGVuc2lvbl0KIwkJW3Byb3RvY29sXQojCQlbcHJveHlwcm90 b2NvbF0KCgojZGVidWc6IDEgICAgICAgICAgICMgdW5jb21tZW50IHRvIGVuYWJs ZSBkZWJ1Z2dpbmcKCiNsb2dvdXRwdXQ6IHN0ZG91dCAgIyB1c2VycyB1c3VhbGx5 IGRvbid0IHdhbnQgdG8gYmUgYm90aGVyZWQgd2l0aCB0aGF0LgoKIyBXaGF0IHBy b3RvY29sIHNob3VsZCBiZSB1c2VkIGZvciByZXNvbHZpbmcgaG9zdG5hbWVzPyAg SXQncyBpbXBvcnRhbnQKIyB0byBzZXQgdGhpcyByaWdodC4KI3Jlc29sdmVwcm90 b2NvbDogdWRwICAjIGRlZmF1bHQKI3Jlc29sdmVwcm90b2NvbDogdGNwICAjIHNl dCB0aGlzIGlmIHlvdXIgc29ja3NzZXJ2ZXIgb25seSBzdXBwb3J0cyBzb2Nrc3Y0 LgojcmVzb2x2ZXByb3RvY29sOiBmYWtlICMgc2V0IHRoaXMgaWYgeW91ciBjbGll bnRzIGNhbid0IGFjY2VzcyBuYW1lc2VydmVyLAoJCSAgICAgICAjIG5laXRoZXIg ZGlyZWN0bHkgbm9yIHByb3hpZWQuCgoKCiMKIyB0aGUgcm91dGVzCiMKCiMgc3Bl Y2lmeWluZyByb3V0ZXMgZm9yIGFjY2VwdGluZyByZW1vdGUgY29ubmVjdGlvbnMg KHZpYSBiaW5kKCkpIGlzCiMgZGlmZmljdWx0IHNpbmNlIHdlIGNhbid0IGtub3cg d2hhdCB0aGUgInRvOiIgYWRkcmVzcyBpcwojIHVudGlsIHdlIGFjdHVhbGx5IGdl dCB0aGUgY29ubmVjdGlvbiAgU2luY2Ugd2Ugc3VwcG9ydCBsZXR0aW5nCiMgdGhl IGNsaWVudCBhY2NlcHQgY29ubmVjdGlvbnMgYm90aCB2aWEgdGhlIHByb3h5c2Vy dmVyIGFuZAojICJkaXJlY3RseSIgYXQgdGhlIHNhbWUgdGltZSwgd2UgaGF2ZSB0 d28gb3B0aW9ucyB0aG91Z2g6CiMgYSkgc3BlY2lmeSBhIHJvdXRlIGZvciBiaW5k IChvbmx5KSBmaXJzdCBnb2luZyB2aWEgdGhlIHByb3h5c2VydmVyLgojICAgIFRo aXMgd2lsbCBhbHNvIGhhbmRsZSAiZGlyZWN0IiBjb25uZWN0aW9ucy4KIyBiKSBz cGVjaWZ5IGEgcm91dGUgZm9yIGJpbmQgKG9ubHkpIGZpcnN0IGdvaW5nICJkaXJl Y3QiLgojICAgIFRoaXMgbWVhbnMgY2xpZW50cyB3aWxsIG9ubHkgYmUgYWJsZSB0 byBhY2NlcHQgImRpcmVjdCIKIyAgICBjb25uZWN0aW9ucy4KCiMgd2Ugd2FudCB0 byBhY2NlcHQgcmVtb3RlIGNvbm5lY3Rpb25zIHZpYSB0aGUgcHJveHlzZXJ2ZXIu CiNyb3V0ZSB7CiMJZnJvbTogMC4wLjAuMC8wIHRvOiAwLjAuMC4wLzAgdmlhOiAx MC4xLjEuMSBwb3J0ID0gMTA4MAojCWNvbW1hbmQ6IGJpbmQKI30KCiMgd2UgZG8g bm90IHdhbnQgdG8gYWNjZXB0IHJlbW90ZSBjb25uZWN0aW9ucyB2aWEgdGhlIHBy b3h5c2VydmVyLgojcm91dGUgewojCWZyb206IDAuMC4wLjAvMCB0bzogMC4wLjAu MC8wIHZpYTogZGlyZWN0CiMJY29tbWFuZDogYmluZAojfQoKCiMgaWYgeW91IGRv bid0IHJvdXRlIGFsbCBsb2NhbCBjb25uZWN0aW9ucyB2aWEgZGlyZWN0LCB5b3Ug c2hvdWxkCiMgYXQgbGVhc3Qgcm91dGUgbmFtZXNlcnZlciBjb25uZWN0aW9ucyB2 aWEgZGlyZWN0IGNvbm5lY3Rpb25zIGlmIHlvdQojIGNhbi4gIFRoYXQgY2FuIG1h a2UgZm9yIG11Y2ggYmV0dGVyIHBlcmZvcm1hbmNlLCBkZXBlbmRpbmcgb24KIyB5 b3VyIHNldHVwLiAgTWFrZSBzdXJlIHRoZSBuYW1lc2VydmVyIGxpbmUgaXMgdGhl IGZpcnN0LgojCiMgQXNzdW1pbmcgeW91ciBuYW1lc2VydmVyIHJ1bnMgb24gYWRk cmVzcyAxMC4xLjEuMSwgeW91IGNhbiBkbyBpdCBsaWtlIHRoaXM6CiNyb3V0ZSB7 CiMJZnJvbTogMC4wLjAuMC8wIHRvOiAxMC4xLjEuMS8zMiBwb3J0ID0gZG9tYWlu IHZpYTogZGlyZWN0CiN9CgoKIyBoYXZlIGEgcm91dGUgbWFraW5nIGFsbCBjb25u ZWN0aW9ucyB0byBsb29wYmFjayBhZGRyZXNzZXMgYmUgZGlyZWN0Lgojcm91dGUg ewojCWZyb206IDAuMC4wLjAvMCAgIHRvOiAxMjcuMC4wLjAvOCAgdmlhOiBkaXJl Y3QKIwljb21tYW5kOiBjb25uZWN0IHVkcGFzc29jaWF0ZSAjIGV2ZXJ5dGhpbmcg YnV0IGJpbmQsIGJpbmQgY29uZnVzZXMgdXMuCiN9CgojIE91ciBuZXQgaXMgdGhl IDEwLjAuMC4wLzggbmV0LCBsZXQgY2xpZW50cyBnb2luZyB0byBsb2NhbCBhZGRy ZXNzIGdvCiMgZGlyZWN0LCBub3QgdmlhIHNlcnZlci4KI3JvdXRlIHsKIwlmcm9t OiAwLjAuMC4wLzAgICB0bzogMTAuMC4wLjAvOCAgIHZpYTogZGlyZWN0CiN9Cgoj IGZvciBwb29yIHNvdWxzIHRyYXBwZWQgYmVoaW5kIGEgbXNwcm94eSBzZXJ2ZXIu CiNyb3V0ZSB7CiMJZnJvbTogMC4wLjAuMC8wICAgdG86IDAuMC4wLjAvMCAgIHZp YTogMTAuMS4xLjEgcG9ydCA9IDE3NDUKIwlwcm90b2NvbDogdGNwCQkJICMgc2Vy dmVyIHN1cHBvcnRzIHRjcAojCXByb3h5cHJvdG9jb2w6IG1zcHJveHlfdjIgICAg ICAgICMgc2VydmVyIHJ1bnMgbXNwcm94eV92MgojfQoKIyBjbGllbnRzIGdvaW5n IGFueXdoZXJlIGVsc2UgZ28gdmlhIHNlcnZlciBsaXN0ZW5pbmcgYXQKIyBJUCBh ZGRyZXNzIDEwLjEuMS4xLCBwb3J0IDEwODAuICAgTm90ZSB0aGF0IHVubGVzcyB5 b3UgaGF2ZQojIHNwZWNpZmllZCBhIGRpcmVjdCBjb25uZWN0aW9uIGZvciBETlMs IG9yIHRoZSBzb2Nrc3NlcnZlciBpcyByZXNvbHZhYmxlCiMgd2l0aG91dCBuZXR3 b3JrIHRyYWZmaWMsIHlvdSBjYW4ndCBnaXZlIGEgaG9zdG5hbWUgZm9yIHRoZSBz b2Nrc3NlcnZlciwKIyB5b3UgbXVzdCBnaXZlIGEgSVAgYWRkcmVzcy4gICh0aGUg cmVhc29ucyBmb3IgdGhhdCBhcmUgbG9naWNhbCBlbm91Z2gsCiMgeW91IHdvdWxk IGNyZWF0ZSBhIGxvb3Agb3RoZXJ3aXNlLikKI3JvdXRlIHsKIwlmcm9tOiAwLjAu MC4wLzAgICB0bzogMC4wLjAuMC8wICAgdmlhOiAxMC4xLjEuMSBwb3J0ID0gMTA4 MAojCXByb3RvY29sOiB0Y3AgdWRwICAgICAgICAgICAgICAgICMgc2VydmVyIHN1 cHBvcnRzIHRjcCBhbmQgdWRwLgojCXByb3h5cHJvdG9jb2w6IHNvY2tzX3Y0IHNv Y2tzX3Y1ICMgc2VydmVyIHN1cHBvcnRzIHNvY2tzIHY0IGFuZCB2NS4KIwltZXRo b2Q6IG5vbmUgI3VzZXJuYW1lCQkgIyB3ZSBhcmUgd2lsbGluZyB0byBhdXRoZW50 aWNhdGUgdmlhCiMJCQkJCSAjIG1ldGhvZCAibm9uZSIsIG5vdCAidXNlcm5hbWUi LgojfQoKIyB0aGlzIGlzIGlkZW50aWNhbCB0byB0aGUgYWJvdmUsIGJ1dCBpdCBt YXRjaGVzIGhvc3RuYW1lcyBpbnN0ZWFkLgojIFRoaXMgaXMgaWYgeW91IGhhdmUg Y2xpZW50cyB0aGF0IGFyZSB1bmFibGUgdG8gcmVzb2x2ZSBob3N0bmFtZXMuCiMg SXQgY2FuIGJlIGltcG9ydGFudCB0aGF0IGhvc3RuYW1lIHJvdXRlcyBjb21lIGFm dGVyIGFkZHJlc3Mgcm91dGVzLgojcm91dGUgewojCWZyb206IDAuMC4wLjAvMCAg IHRvOiAuICAgdmlhOiAxMC4xLjEuMSBwb3J0ID0gMTA4MAojCXByb3RvY29sOiB0 Y3AgdWRwICAgICAgICAgICAgICAgICMgc2VydmVyIHN1cHBvcnRzIHRjcCBhbmQg dWRwLgojCXByb3h5cHJvdG9jb2w6IHNvY2tzX3Y0IHNvY2tzX3Y1ICMgc2VydmVy IHN1cHBvcnRzIHNvY2tzIHY0IGFuZCB2NS4KIwltZXRob2Q6IG5vbmUgI3VzZXJu YW1lCQkgIyB3ZSBhcmUgd2lsbGluZyB0byBhdXRoZW50aWNhdGUgdmlhCiMJCQkJ CSAjIG1ldGhvZCAibm9uZSIsIG5vdCAidXNlcm5hbWUiLgojfQoKIyBpZGVudGlj YWwgdG8gYWJvdmUgdHdvIHJvdXRlcywgYnV0IHVzaW5nIGEgaHR0cHByb3h5IGlu c3RlYWQuCiMKCiNyb3V0ZSB7CiMJZnJvbTogMC4wLjAuMC8wICAgdG86IDAuMC4w LjAvMCAgIHZpYTogMTAuMS4xLjEgcG9ydCA9IDMxMjgKIwljb21tYW5kOiBjb25u ZWN0CQkgIyBvbmx5IHRoaW5nIGEgaHR0cHJveHkgc3VwcG9ydHMuCiMJcHJveHlw cm90b2NvbDogaHR0cF92MS4wCiN9Cgojcm91dGUgewojCWZyb206IDAuMC4wLjAv MCAgIHRvOiAuICAgdmlhOiAxMC4xLjEuMSBwb3J0ID0gMzEyOAojCWNvbW1hbmQ6 IGNvbm5lY3QJCSAjIG9ubHkgdGhpbmcgYSBodHRwcm94eSBzdXBwb3J0cy4KIwlw cm94eXByb3RvY29sOiBodHRwX3YxLjAKI30KAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA --Boundary_(ID_neg25AIe/riohtgjnHdu6g)-- From Mayuresh.Nirhali@sun.com Wed Dec 3 01:08:14 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mB398C6G014592; Wed, 3 Dec 2008 01:08:13 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id mB3985bg026975; Wed, 3 Dec 2008 17:08:11 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KBA00C3CMPL7B00@brm-avmta-1.central.sun.com>; Wed, 03 Dec 2008 02:08:09 -0700 (MST) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KBA00ATUMPIVW00@brm-avmta-1.central.sun.com>; Wed, 03 Dec 2008 02:08:08 -0700 (MST) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mB3985V5029890; Wed, 03 Dec 2008 09:08:05 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KBA00G01MOAQ500@mail-apac.sun.com> (original mail from Mayuresh.Nirhali@Sun.COM); Wed, 03 Dec 2008 17:08:05 +0800 (SGT) Received: from [129.158.227.167] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KBA00C5AMPAWDMD@mail-apac.sun.com>; Wed, 03 Dec 2008 17:08:04 +0800 (SGT) Date: Wed, 03 Dec 2008 14:37:57 +0530 From: Mayuresh Nirhali Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <18739.60270.867151.253792@gargle.gargle.HOWL> Sender: Mayuresh.Nirhali@sun.com To: James Carlson Cc: Gary Winiger , James.Gates@sun.com, psarc-ext@sun.com, lsarc-ext@sun.com Message-id: <49364C6D.1050607@Sun.COM> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_neg25AIe/riohtgjnHdu6g)" X-PMX-Version: 5.4.1.325704 References: <200811282044.mASKiQal005356@marduk.eng.sun.com> <18739.60270.867151.253792@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.16 (X11/20080908) Status: RO Content-Length: 103067 This is a multi-part message in MIME format. --Boundary_(ID_neg25AIe/riohtgjnHdu6g) Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Thanks Gary and James, I have updated the man pages and attaching them here for further review. Also please find updated PSARC material attached with this mail. The material include the sample configuration files and updated one_pager & the proposal document. Please review and let me know your comments. I still have not received any response from the dante maintainers. I will start looking into creating a patch that will fix the Solaris issues with dante, ofcourse with help from some of you. Thanks Mayuresh James Carlson wrote: > Gary Winiger writes: > >> That said, one of the exported interfaces for all PAM applications >> is the service name. Perhaps I missed it in the exported interfaces. >> Stability should likely be no lower than Uncommitted. The service >> > > Agreed; that's missing. Looking at the code, that's "sockd" by > default and can be overridden in the configuration file by using: > > pamservicename: new-name-here > > >> Furthermore, a project could create a PAM service module just >> to handle socks username/password authentication (and account >> management) that didn't need to be tied to the hosts passwd(4) and >> shadow(4) databases -- that may require no privilege. >> > > Yes, a future project could do that, but I think doing it would > actually drain a good part of the usefulness of PAM, at least for this > project. > > The problem is that administering users (and passwords) in a > service-specific way scales poorly and is hard to manage. Even if > it's not "clean," many administrators would rather have a central > registry for all users authenticated by the system for all > applications, so that when a user is added or removed, they don't have > to hunt down all the places where this data is squirrelled away. > > Having per-service files greatly complicates matters, and virtually > guarantees that something will be missed when changes are needed. > > --Boundary_(ID_neg25AIe/riohtgjnHdu6g) Content-type: application/x-tar; name=danteman.tar Content-transfer-encoding: BASE64 Content-disposition: inline; filename=danteman.tar bWFuL21hbjEvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAADAwMDA3MTEAMDQwNzE1NgAwMDAwMDEyADAwMDAwMDAwMDAwADEwNzcyNDAz MDAyADAwMTI3NTcANQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAB1c3RhcgAwMG1uMTMzNzY2AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAc3RhZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwMTQ2 ADAwMDAwMDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABtYW4vbWFuMS9zb2Nrc2lm eS4xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDAwMDcxMQAwNDA3 MTU2ADAwMDAwMTIAMDAwMDAwMDMxNDcAMTExMTU0NDQ1MzYAMDAxNDcxNAAwAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AHVzdGFyADAwbW4xMzM3NjYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABzdGFmZgAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAwMDAxNDYAMDAwMDAwMwAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAC5cXCIgYXV0by1nZW5lcmF0ZWQgYnkgZG9jYm9vazJt YW4tc3BlYyAkUmV2aXNpb246IDEuMS4xLjEgJAouVEggIlNPQ0tTSUZZIiAiMSIg IjIwMDgtMDMtMjUiICJBcHBsaWNhdGlvbiIgIlNvY2tzIENsaWVudCBQcm9ncmFt IgouU0ggTkFNRQpzb2Nrc2lmeSBcLSBkeW5hbWljYWxseSBTT0NLU2lmaWVzIGEg cHJvZ3JhbQouU0ggU1lOT1BTSVMKXGZCc29ja3NpZnlcZlIgXGZCXGZJcHJvZ3Jh bVxmQlxmUiBbIFxmQlxmSWFyZ3VtZW50c1xmQlxmSVxmUiBdCi5TSCAiREVTQ1JJ UFRJT04iClxmQnNvY2tzaWZ5XGZSIGlzIERhbnRlJ3MgZXF1aXZhbGVudCBvZiB0 aGUgTkVDIFNPQ0tTJyBcZkJydW5zb2Nrc1xmUiwKc29ja3NpZnkgdXNlcyBcZkJM RF9QUkVMT0FEXGZSIGVudmlyb25tZW50IHZhcmlhYmxlIHRvIHdyYXAgYWxsIApu ZXR3b3JraW5nLXJlbGF0ZWQgc3lzdGVtIGNhbGxzIHNvIHRoYXQgcHJvZ3JhbXMg Y2FuIGdvIHRocm91Z2ggYSAKU09DS1Mgc2VydmVyIHRoYXQgd2FzIGluc3RhbGxl ZCBhcyBwYXJ0IG9mIGEgZmlyZXdhbGwuCi5QUApEYW50ZSBTT0NLUyBpbXBsZW1l bnRhdGlvbiBpcyBkZWxpdmVyZWQgYXMgcGFydCBvZiBmb2xsb3dpbmcgMiBwYWNr YWdlczoKLlBQClNVTldsaWJzb2NrcyAgRGFudGUgQ2xpZW50IGxpYnJhcmllcwou YnIKU1VOV2RhbnRlciAgICBEYW50ZSBTZXJ2ZXIgKHJvb3QpCi5icgpTVU5XZGFu dGV1ICAgIERhbnRlIFNlcnZlciAodXNlcikKLlBQCi5TSCAiT1BUSU9OUyIKLlBQ Ci5UUApcZkJcZklwcm9ncmFtXGZCXGZSClRoZSBwcm9ncmFtIHRoYXQgaXMgdG8g YmUgc29ja3NpZmllZC4gVGhlIFxmQlxmSWFyZ3VtZW50c1xmQlxmUiBhcmUgcHJv Z3JhbSAKYXJndW1lbnRzIHRvIHRoZSBwcm9ncmFtIGFuZCBub3QgdG8gc29ja3Np ZnkuCi5QUAouU0ggIkZJTEVTIgouUFAKLlRQClxmQi9ldGMvc29ja3MuY29uZlxm UgpEYW50ZSBjbGllbnQgY29uZmlndXJhdGlvbiBmaWxlLgouU0ggIkVYQU1QTEVT IgouUFAKVG8gY2hlY2tvdXQgYSBzdWJ2ZXJzaW9uIHJlcG9zaXRvcnkgZnJvbSBi ZWhpbmQgYSBmaXJld2FsbCwgRG8sCi5zcAoubmYKc29ja3NpZnkgc3ZuIGNvIDxz dm4tcmVwb3NpdG9yeS11cmw+Ci5zcAouZmkKLlBQCi5TSCAiU0VFIEFMU08iClxm QnNvY2tzLmNvbmZcZlIoNCksIFxmQnNvY2tkXGZSKDFtKSwgXGZCc29ja2QuY29u ZlxmUig0KQouU0ggIk5PVEVTIgouUFAKQSBtb3JlIHBlcm1hbmVudCBzb2x1dGlv biB3b3VsZCBiZSB0byBhZGQgdGhlICBMRF9QUkVMT0FEIGVudmlyb25tZW50IHZh bHVlIAp0byB0aGUgc2hlbGwgc3RhcnR1cCBmaWxlcy4gIFRoZW4gYWxsIG5vbi1z ZXRbdWddaWQgYXBwbGljYXRpb25zIHRoYXQgYXJlIApsaW5rZWQgZHluYW1pY2Fs bHkgd291bGQgYmUgc29ja3NpZmllZC4gIEhvd2V2ZXIgdGhpcyBjYW4gaGF2ZSBi YWQgc2lkZS1lZmZlY3RzLgouU0ggIkFVVEhPUiIKLlBQCkRhbnRlIHdhcyBkZXZl bG9wZWQgZm9yIEluZmVybm8gTmV0dHZlcmsgQS9TLCBOb3J3YXkgYnk6IE1pY2hh ZWwgU2h1bGRtYW4gPG1pY2hhZWxzQGluZXQubm8+OiAKRGVzaWduIGFuZCBpbXBs ZW1lbnRhdGlvbi4gLSBLYXJsLUFuZHI/IFNrZXZpayA8a2FybHNAaW5ldC5ubz46 IEF1dG9jb25mIGFuZCBwb3J0aW5nLgoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA bWFuL21hbjFtLwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAADAwMDA3MTEAMDQwNzE1NgAwMDAwMDEyADAwMDAwMDAwMDAwADExMTE1NDQ0 NTE2ADAwMTMxNDMANQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAB1c3RhcgAwMG1uMTMzNzY2AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAc3RhZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwMTQ2 ADAwMDAwMDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABtYW4vbWFuMW0vc29ja2Qu MW0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDAwMDYwMAAwNDA3 MTU2ADAwMDAwMTIAMDAwMDAwMTM0MjIAMTExMTU0NDQ1MTYAMDAxNDUwNwAwAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AHVzdGFyADAwbW4xMzM3NjYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABzdGFmZgAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAwMDAxNDYAMDAwMDAwMwAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAC5cIiAkSWQ6IHNvY2tkLjgsdiAxLjI5IDIwMDUvMDEv MjQgMTA6MjQ6MjAga2FybHMgRXhwICQKLlwiCi5cIiBDb3B5cmlnaHQgKGMpIDE5 OTcsIDE5OTgsIDE5OTksIDIwMDAsIDIwMDEsIDIwMDIsIDIwMDQKLlwiICAgICAg SW5mZXJubyBOZXR0dmVyayBBL1MsIE5vcndheS4gIEFsbCByaWdodHMgcmVzZXJ2 ZWQuCi5cIgouXCIgUmVkaXN0cmlidXRpb24gYW5kIHVzZSBpbiBzb3VyY2UgYW5k IGJpbmFyeSBmb3Jtcywgd2l0aCBvciB3aXRob3V0Ci5cIiBtb2RpZmljYXRpb24s IGFyZSBwZXJtaXR0ZWQgcHJvdmlkZWQgdGhhdCB0aGUgZm9sbG93aW5nIGNvbmRp dGlvbnMKLlwiIGFyZSBtZXQ6Ci5cIiAxLiBUaGUgYWJvdmUgY29weXJpZ2h0IG5v dGljZSwgdGhpcyBsaXN0IG9mIGNvbmRpdGlvbnMgYW5kIHRoZSBmb2xsb3dpbmcK LlwiICAgIGRpc2NsYWltZXIgbXVzdCBhcHBlYXIgaW4gYWxsIGNvcGllcyBvZiB0 aGUgc29mdHdhcmUsIGRlcml2YXRpdmUgd29ya3MKLlwiICAgIG9yIG1vZGlmaWVk IHZlcnNpb25zLCBhbmQgYW55IHBvcnRpb25zIHRoZXJlb2YsIGFzd2VsbCBhcyBp biBhbGwKLlwiICAgIHN1cHBvcnRpbmcgZG9jdW1lbnRhdGlvbi4KLlwiIDIuIEFs bCBhZHZlcnRpc2luZyBtYXRlcmlhbHMgbWVudGlvbmluZyBmZWF0dXJlcyBvciB1 c2Ugb2YgdGhpcyBzb2Z0d2FyZQouXCIgICAgbXVzdCBkaXNwbGF5IHRoZSBmb2xs b3dpbmcgYWNrbm93bGVkZ2VtZW50OgouXCIgICAgICBUaGlzIHByb2R1Y3QgaW5j bHVkZXMgc29mdHdhcmUgZGV2ZWxvcGVkIGJ5Ci5cIiAgICAgIEluZmVybm8gTmV0 dHZlcmsgQS9TLCBOb3J3YXkuCi5cIiAzLiBUaGUgbmFtZSBvZiB0aGUgYXV0aG9y IG1heSBub3QgYmUgdXNlZCB0byBlbmRvcnNlIG9yIHByb21vdGUgcHJvZHVjdHMK LlwiICAgIGRlcml2ZWQgZnJvbSB0aGlzIHNvZnR3YXJlIHdpdGhvdXQgc3BlY2lm aWMgcHJpb3Igd3JpdHRlbiBwZXJtaXNzaW9uLgouXCIKLlwiIFRISVMgU09GVFdB UkUgSVMgUFJPVklERUQgQlkgVEhFIEFVVEhPUiBgYEFTIElTJycgQU5EIEFOWSBF WFBSRVNTIE9SCi5cIiBJTVBMSUVEIFdBUlJBTlRJRVMsIElOQ0xVRElORywgQlVU IE5PVCBMSU1JVEVEIFRPLCBUSEUgSU1QTElFRCBXQVJSQU5USUVTCi5cIiBPRiBN RVJDSEFOVEFCSUxJVFkgQU5EIEZJVE5FU1MgRk9SIEEgUEFSVElDVUxBUiBQVVJQ T1NFIEFSRSBESVNDTEFJTUVELgouXCIgSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFV VEhPUiBCRSBMSUFCTEUgRk9SIEFOWSBESVJFQ1QsIElORElSRUNULAouXCIgSU5D SURFTlRBTCwgU1BFQ0lBTCwgRVhFTVBMQVJZLCBPUiBDT05TRVFVRU5USUFMIERB TUFHRVMgKElOQ0xVRElORywgQlVUCi5cIiBOT1QgTElNSVRFRCBUTywgUFJPQ1VS RU1FTlQgT0YgU1VCU1RJVFVURSBHT09EUyBPUiBTRVJWSUNFUzsgTE9TUyBPRiBV U0UsCi5cIiBEQVRBLCBPUiBQUk9GSVRTOyBPUiBCVVNJTkVTUyBJTlRFUlJVUFRJ T04pIEhPV0VWRVIgQ0FVU0VEIEFORCBPTiBBTlkKLlwiIFRIRU9SWSBPRiBMSUFC SUxJVFksIFdIRVRIRVIgSU4gQ09OVFJBQ1QsIFNUUklDVCBMSUFCSUxJVFksIE9S IFRPUlQKLlwiIChJTkNMVURJTkcgTkVHTElHRU5DRSBPUiBPVEhFUldJU0UpIEFS SVNJTkcgSU4gQU5ZIFdBWSBPVVQgT0YgVEhFIFVTRSBPRgouXCIgVEhJUyBTT0ZU V0FSRSwgRVZFTiBJRiBBRFZJU0VEIE9GIFRIRSBQT1NTSUJJTElUWSBPRiBTVUNI IERBTUFHRS4KLlwiCi5cIiBJbmZlcm5vIE5ldHR2ZXJrIEEvUyByZXF1ZXN0cyB1 c2VycyBvZiB0aGlzIHNvZnR3YXJlIHRvIHJldHVybiB0bwouXCIKLlwiICBTb2Z0 d2FyZSBEaXN0cmlidXRpb24gQ29vcmRpbmF0b3IgIG9yICBzZGNAaW5ldC5ubwou XCIgIEluZmVybm8gTmV0dHZlcmsgQS9TCi5cIiAgT3NsbyBSZXNlYXJjaCBQYXJr Ci5cIiAgR2F1c3RhZGFsbOllbiAyMQouXCIgIE5PLTAzNDkgT3NsbwouXCIgIE5v cndheQouXCIKLlwiIGFueSBpbXByb3ZlbWVudHMgb3IgZXh0ZW5zaW9ucyB0aGF0 IHRoZXkgbWFrZSBhbmQgZ3JhbnQgSW5mZXJubyBOZXR0dmVyayBBL1MKLlwiIHRo ZSByaWdodHMgdG8gcmVkaXN0cmlidXRlIHRoZXNlIGNoYW5nZXMuCi5cIgouVEgg U09DS0QgMW0gIk5vdiAyOCwgMjAwOCIKLlNIIE5BTUUKc29ja2QgXC0gTmV0d29y ayBTT0NLUyBzZXJ2ZXIKLlNIIFNZTk9QU0lTCi5CIHNvY2tkCi5SQiBbIFwtRExW ZGhudiBdCi5SQiBbIFwtTgouSVIgbnVtYmVyIF0KLlJCIFsgXC1mCi5JUiBmaWxl IF0KLlNIIERFU0NSSVBUSU9OCi5CIERhbnRlCmltcGxlbWVudHMgdGhlIHNvY2tz IHN0YW5kYXJkIGFuZCBjYW4gZnVuY3Rpb24gYXMgYSBmaXJld2FsbCBiZXR3ZWVu IG5ldHdvcmtzLgouUFAKLkIgRGFudGUKcmVsYXlzIFRDUCBhbmQgVURQIGJvdGgg ZnJvbSBvdXRzaWRlIHRoZSBuZXR3b3JrIGFuZCBpbiwgYW5kIGZyb20gaW5zaWRl CmFuZCBvdXQuCi5QUApEYW50ZSBzZXJ2ZXIgY2FuIGJlIGFkbWluaXN0ZXJlZCB1 c2luZyB0aGUgZGVmYXVsdCBTTUYgc2VydmljZS4gRm9yCmRhbnRlIHNlcnZlciB0 byBzdGFydCBzdWNjZXNzZnVsbHksIHRoZSBzZXJ2ZXIgY29uZmlndXJhdGlvbiBm aWxlIG11c3QgYmUgCnBvcHVsYXRlZCB3aXRoIGF0bGVhc3QgdGhlIG5lY2Vzc2Fy eSBpbmZvcm1hdGlvbiAoZS5nLiB0aGUgbmV0d29yayBkZXZpY2Ugd2l0aAp3aGlj aCBkYW50ZSBzZXJ2ZXIgd291bGQgb3BlcmF0ZSkuIElmIHRoZSBzZXJ2ZXIgY29u ZmlndXJhdGlvbiBmaWxlIGlzIG5vdCB1cGRhdGVkLCB0aGVuIHRoZSBTTUYgc2Vy dmljZSBnb2VzIGludG8gbWFpbnRhaW5hbmNlIG1vZGUgd2hlbiBlbmFibGVkLgou UFAKRGFudGUgU09DS1MgaW1wbGVtZW50YXRpb24gaXMgZGVsaXZlcmVkIGFzIHBh cnQgb2YgZm9sbG93aW5nIDMgcGFja2FnZXM6Ci5QUApTVU5XbGlic29ja3MgIERh bnRlIENsaWVudCBsaWJyYXJpZXMKLmJyClNVTldkYW50ZXIgICAgRGFudGUgU2Vy dmVyIChSb290KQouYnIKU1VOV2RhbnRldSAgICBEYW50ZSBTZXJ2ZXIgKFVzZXIp Ci5QUApUaGUgU1VOV2RhbnRlciBwYWNrYWdlIGFsc28gaW5zdGFsbHMgdGhlIGZv bGxvd2luZyBTTUYKZmlsZXMgdG8gZmFjaWxpdGF0ZSBzZXJ2aWNlIG1hbmFnZW1l bnQgKHJlZmVyIHRvIHNtZig1KQphbmQgdGhlIFNNRiBzZWN0aW9uIGJlbG93KToK LlJTCi5QUApUaGUgb3B0aW9ucyBhcmUgYXMgZm9sbG93czoKLlRQCi5CIFwtRAou QiBEYW50ZQp3aWxsIGRldGFjaCBmcm9tIHRoZSBjb250cm9sbGluZyB0ZXJtaW5h bCBhbmQgcnVuIGluCnRoZSBiYWNrZ3JvdW5kIGFzIGEgc3lzdGVtIGRhZW1vbi4g VGhlIGRlZmF1bHQgU01GIHNlcnZpY2UKdXNlcyB0aGlzIG9wdGlvbiB0byBzdGFy dCB0aGUgZGFudGUgc2VydmVyLgouVFAKLkIgXC1MCkRpc3BsYXlzIHRoZSBsaWNl bnNlCi5CIERhbnRlCmNvbWVzIHVuZGVyLgouVFAKLkJJIFwtTiBudW1iZXIKLkIg RGFudGUKd2lsbCBmb3JrIG9mCi5JIG51bWJlcgpjb3BpZXMgb2YgaXRzZWxmIHdo ZW4gc3RhcnRpbmcuICBDYW4gYmUgdXNlZCBmb3IgdmVyeSBidXN5IHNlcnZlcnMu Ci5UUAouQiBcLVYKVmVyaWZpZXMgY29uZmlnIGZpbGUgYW5kIGV4aXRzLgouVFAK LkIgXC1kCkVuYWJsZXMgZGVidWdnaW5nLgouVFAKLkJJIFwtZiBmaWxlCi5CIERh bnRlCndpbGwgcmVhZCBpdHMgY29uZmlndXJhdGlvbiBmcm9tCi5JUiBmaWxlIC4K LlRQCi5CIFwtaApTaG93cyB0aGUgY3VycmVudGx5IHZhbGlkIG9wdGlvbnMuCi5U UAouQiBcLW4KRGlzYWJsZXMgVENQIGtlZXAtYWxpdmUgbWVzc2FnZXMuICBOb3Jt YWxseQouQiBEYW50ZQplbmFibGVzIFRDUCBrZWVwLWFsaXZlIG1lc3NhZ2VzIHNv IHRoYXQgY29ubmVjdGlvbnMgZnJvbSBtYWNoaW5lcyB0aGF0CmhhdmUgY3Jhc2hl ZCBvciBmb3Igb3RoZXIgcmVhc29ucyBubyBsb25nZXIgY2FuIGJlIHJlYWNoZWQg dGltZSBvdXQuCi5UUAouQiBcLXYKRGlzcGxheXMKLkIgRGFudGUKdmVyc2lvbi4K LlNIIEVOVklST05NRU5UCi5UUAouQiBUTVBESVIKVXNlCi5CIFRNUERJUgpmb3Ig dGVtcG9yYXJ5IGZpbGVzLiAgU2luY2UKLkIgRGFudGUKdXNlcyBsb2NrZmlsZXMg aXQgaXMgcmVjb21tZW5kZWQgdGhhdAouQiBUTVBESVIKYmUgc2V0IHRvIGEgKGxv Y2FsKSBmaWxlc3lzdGVtIHdpdGggbG93IGxhdGVuY3kuCi5QUAouVFAKLkIgU09D S1NfVVNFUk5BTUUKVGhlIHNvY2tzIHVzZXJuYW1lIHVzZWQgZm9yIGF1dGhlbnRp Y2F0aW9uLgouUFAKLlRQCi5CIFNPQ0tTX1BBU1NXT1JEClBhc3N3b3JkIHVzZWQg Zm9yIGF1dGhlbnRpY2F0aW9uIHdpdGgKLkIgU09DS1NfVVNFUk5BTUUKLlNIIEZJ TEVTCi5UUAovZXRjL3NvY2tkLmNvbmYKLkIgRGFudGUKc2VydmVyIGNvbmZpZ3Vy YXRpb24gZmlsZS4KLlNIIFNFQ1VSSVRZCnNvY2tkLCBvciB0aGUgZGFudGUgU09D S1Mgc2VydmVyLCBzdXBwb3J0cyBmb2xsb3dpbmcgdXNlciBhdXRoZW50aWNhdGlv biAKbWVjaGFuaXNtcyBwcm92aWRlZCBieSBTb2xhcmlzLAouVFAKLkIgdXNlcm5h bWUsIHJmYywgcGFtKDNQQU0pIAouUFAKVGhlIHNlcnZlciBjb25maWd1cmF0aW9u IGZpbGUgZGVmaW5lcyB0d28gdmFyaWFibGVzIGFzLCB1c2VyLnByaXZpbGVnZWQK YW5kIHVzZXIubm90cHJpdmlsZWdlZC4gVGhlc2UgMiB2YXJpYWJsZXMgY2FuIGhh dmUgYSBsaXN0IG9mIHVzZXJpZHMgc2VwYXJhdGVkCmJ5IGNvbW1hLiBUaGUgc2Vy dmVyIGltcGxlbWVudGF0aW9uIGNhbGxzIHNldGV1aWQgZnVuY3Rpb24gdG8gc3dp dGNoIGJldHdlZW4KcHJpdmlsZWdlZCBhbmQgbm90cHJpdmlsZWdlZCB1c2Vycy4g VXBvbiBzdGFydCwgdGhlIHNlcnZlciBzd2l0Y2hlcyB0aGUKZWZmZWN0aXZlIGlk IGZyb20gdGhlIHVzZXIgd2hvIHN0YXJ0ZWQgdGhlIHNlcnZlciB0byB0aGUgc3Bl Y2lmaWVkIAp1c2VyLm5vdHByaXZpbGVnZWQuIExhdGVyLCBmb3IgYWxsIHRoZSBw cml2aWxlZ2VkIG9wZXJhdGlvbnMgKGUuZy4gUEFNIAphdXRoZW50aWNhdGlvbiks IHRoZSBzZXJ2ZXIgc2V0cyB0aGUgZWZmZWN0aXZlIHVzZXIgSUQgZnJvbSB1c2Vy Lm5vdHByaXZpbGVnZWQgCnRvIHNwZWNpZmllZCB1c2VyLnByaXZpbGVnZWQgYnkg Y2FsbGluZyBzZXRldWlkIGZ1bmN0aW9uLgouc3AKLkxQCkZvciBzb2NrZCB1c2Vy IGF1dGhlbnRpY2F0aW9uIHR5cGUsIFxmQnBhbVxmUjsgdGhlIHJlcXVpcmVkIFBB TSBzZXJ2aWNlbmFtZSBpcwpcZkJzb2NrZFxmUi4gVGhlIGRlZmF1bHQgUEFNIHNl cnZpY2Ugc3RhY2sgdG8gYmUgZGVmaW5lZCBpbiAvZXRjL3BhbS5jb25mIGlzIGFz IApiZWxvdywKLnNwCi5MUApzb2NrZAlhdXRoCXJlcXVpc2l0ZQlwYW1fYXV0aHRv a19nZXQuc28uMQpzb2NrZAlhdXRoCXJlcXVpcmVkCXBhbV9kaGtleXMuc28uMQpz b2NrZAlhdXRoCXJlcXVpcmVkCXBhbV91bml4X2NyZWQuc28uMQpzb2NrZAlhdXRo CXJlcXVpcmVkCXBhbV91bml4X2F1dGguc28uMQouU0ggQVVUSE9SUwpGb3IgSW5m ZXJubyBOZXR0dmVyayBBL1MsIE5vcndheToKIE1pY2hhZWwgU2h1bGRtYW4gPG1p Y2hhZWxzQGluZXQubm8+OiBEZXNpZ24gYW5kIGltcGxlbWVudGF0aW9uLgogS2Fy bC1BbmRyZScgU2tldmlrIDxrYXJsc0BpbmV0Lm5vPjogQXV0b2NvbmYgYW5kIHBv cnRpbmcuCi5TSCBTRUUgQUxTTwpcZkJzb2NrZC5jb25mXGZSKDQpLCBcZkJzb2Nr c2lmeVxmUigxKSwgXGZCc29ja3MuY29uZlxmUig0KQouUFAKSW5mb3JtYXRpb24g YWJvdXQgbmV3IHJlbGVhc2VzIGFuZCBvdGhlciByZWxhdGVkIGlzc3VlcyBjYW4g YmUgZm91bmQKb24gdGhlCi5CIERhbnRlCldXVyBob21lIHBhZ2UgYXQgaHR0cDov L3d3dy5pbmV0Lm5vL2RhbnRlLgouU0ggQlVHUwpTZWUgdGhlIGFjY29tcGFueWlu ZyBCVUdTIGZpbGUuICBOZXcgb25lcyBzaG91bGQgYmUgcmVwb3J0ZWQgdG8KZGFu dGVcLWJ1Z3NAaW5ldC5uby4KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAG1hbi9tYW40LwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwNzExADA0MDcxNTYAMDAwMDAxMgAwMDAw MDAwMDAwMAAxMTExNTQ0NTQ3MwAwMDEyNzc0ADUAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdXN0YXIAMDBtbjEzMzc2 NgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHN0YWZmAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAMDAwMDE0NgAwMDAwMDAzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA bWFuL21hbjQvc29ja3MuY29uZi40AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAADAwMDA2MDAAMDQwNzE1NgAwMDAwMDEyADAwMDAwMDEyNzEyADExMTE1NDQ0 NDUwADAwMTUxMjQAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAB1c3RhcgAwMG1uMTMzNzY2AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAc3RhZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwMTQ2 ADAwMDAwMDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuXCIgJElkOiBzb2Nrcy5j b25mLjUsdiAxLjI3IDIwMDUvMTIvMTkgMTQ6MjI6MTYgbWljaGFlbHMgRXhwICQK LlwiCi5cIiBDb3B5cmlnaHQgKGMpIDE5OTcsIDE5OTgsIDE5OTksIDIwMDAsIDIw MDEsIDIwMDMKLlwiICAgICAgSW5mZXJubyBOZXR0dmVyayBBL1MsIE5vcndheS4g IEFsbCByaWdodHMgcmVzZXJ2ZWQuCi5cIgouXCIgUmVkaXN0cmlidXRpb24gYW5k IHVzZSBpbiBzb3VyY2UgYW5kIGJpbmFyeSBmb3Jtcywgd2l0aCBvciB3aXRob3V0 Ci5cIiBtb2RpZmljYXRpb24sIGFyZSBwZXJtaXR0ZWQgcHJvdmlkZWQgdGhhdCB0 aGUgZm9sbG93aW5nIGNvbmRpdGlvbnMKLlwiIGFyZSBtZXQ6Ci5cIiAxLiBUaGUg YWJvdmUgY29weXJpZ2h0IG5vdGljZSwgdGhpcyBsaXN0IG9mIGNvbmRpdGlvbnMg YW5kIHRoZSBmb2xsb3dpbmcKLlwiICAgIGRpc2NsYWltZXIgbXVzdCBhcHBlYXIg aW4gYWxsIGNvcGllcyBvZiB0aGUgc29mdHdhcmUsIGRlcml2YXRpdmUgd29ya3MK LlwiICAgIG9yIG1vZGlmaWVkIHZlcnNpb25zLCBhbmQgYW55IHBvcnRpb25zIHRo ZXJlb2YsIGFzd2VsbCBhcyBpbiBhbGwKLlwiICAgIHN1cHBvcnRpbmcgZG9jdW1l bnRhdGlvbi4KLlwiIDIuIEFsbCBhZHZlcnRpc2luZyBtYXRlcmlhbHMgbWVudGlv bmluZyBmZWF0dXJlcyBvciB1c2Ugb2YgdGhpcyBzb2Z0d2FyZQouXCIgICAgbXVz dCBkaXNwbGF5IHRoZSBmb2xsb3dpbmcgYWNrbm93bGVkZ2VtZW50OgouXCIgICAg ICBUaGlzIHByb2R1Y3QgaW5jbHVkZXMgc29mdHdhcmUgZGV2ZWxvcGVkIGJ5Ci5c IiAgICAgIEluZmVybm8gTmV0dHZlcmsgQS9TLCBOb3J3YXkuCi5cIiAzLiBUaGUg bmFtZSBvZiB0aGUgYXV0aG9yIG1heSBub3QgYmUgdXNlZCB0byBlbmRvcnNlIG9y IHByb21vdGUgcHJvZHVjdHMKLlwiICAgIGRlcml2ZWQgZnJvbSB0aGlzIHNvZnR3 YXJlIHdpdGhvdXQgc3BlY2lmaWMgcHJpb3Igd3JpdHRlbiBwZXJtaXNzaW9uLgou XCIKLlwiIFRISVMgU09GVFdBUkUgSVMgUFJPVklERUQgQlkgVEhFIEFVVEhPUiBg YEFTIElTJycgQU5EIEFOWSBFWFBSRVNTIE9SCi5cIiBJTVBMSUVEIFdBUlJBTlRJ RVMsIElOQ0xVRElORywgQlVUIE5PVCBMSU1JVEVEIFRPLCBUSEUgSU1QTElFRCBX QVJSQU5USUVTCi5cIiBPRiBNRVJDSEFOVEFCSUxJVFkgQU5EIEZJVE5FU1MgRk9S IEEgUEFSVElDVUxBUiBQVVJQT1NFIEFSRSBESVNDTEFJTUVELgouXCIgSU4gTk8g RVZFTlQgU0hBTEwgVEhFIEFVVEhPUiBCRSBMSUFCTEUgRk9SIEFOWSBESVJFQ1Qs IElORElSRUNULAouXCIgSU5DSURFTlRBTCwgU1BFQ0lBTCwgRVhFTVBMQVJZLCBP UiBDT05TRVFVRU5USUFMIERBTUFHRVMgKElOQ0xVRElORywgQlVUCi5cIiBOT1Qg TElNSVRFRCBUTywgUFJPQ1VSRU1FTlQgT0YgU1VCU1RJVFVURSBHT09EUyBPUiBT RVJWSUNFUzsgTE9TUyBPRiBVU0UsCi5cIiBEQVRBLCBPUiBQUk9GSVRTOyBPUiBC VVNJTkVTUyBJTlRFUlJVUFRJT04pIEhPV0VWRVIgQ0FVU0VEIEFORCBPTiBBTlkK LlwiIFRIRU9SWSBPRiBMSUFCSUxJVFksIFdIRVRIRVIgSU4gQ09OVFJBQ1QsIFNU UklDVCBMSUFCSUxJVFksIE9SIFRPUlQKLlwiIChJTkNMVURJTkcgTkVHTElHRU5D RSBPUiBPVEhFUldJU0UpIEFSSVNJTkcgSU4gQU5ZIFdBWSBPVVQgT0YgVEhFIFVT RSBPRgouXCIgVEhJUyBTT0ZUV0FSRSwgRVZFTiBJRiBBRFZJU0VEIE9GIFRIRSBQ T1NTSUJJTElUWSBPRiBTVUNIIERBTUFHRS4KLlwiCi5cIiBJbmZlcm5vIE5ldHR2 ZXJrIEEvUyByZXF1ZXN0cyB1c2VycyBvZiB0aGlzIHNvZnR3YXJlIHRvIHJldHVy biB0bwouXCIKLlwiICBTb2Z0d2FyZSBEaXN0cmlidXRpb24gQ29vcmRpbmF0b3Ig IG9yICBzZGNAaW5ldC5ubwouXCIgIEluZmVybm8gTmV0dHZlcmsgQS9TCi5cIiAg T3NsbyBSZXNlYXJjaCBQYXJrCi5cIiAgR2F1c3RhZGFsbOllbiAyMQouXCIgIE5P LTAzNDkgT3NsbwouXCIgIE5vcndheQouXCIKLlwiIGFueSBpbXByb3ZlbWVudHMg b3IgZXh0ZW5zaW9ucyB0aGF0IHRoZXkgbWFrZSBhbmQgZ3JhbnQgSW5mZXJubyBO ZXR0dmVyayBBL1MKLlwiIHRoZSByaWdodHMgdG8gcmVkaXN0cmlidXRlIHRoZXNl IGNoYW5nZXMuCi5cIgouVEggU09DS1MuQ09ORiA1ICJGZWJydWFyeSAxNywgMjAw MSIKLlNIIE5BTUUKc29ja3MuY29uZiBcLSBzb2NrcyBjbGllbnQgY29uZmlndXJh dGlvbiBmaWxlIHN5bnRheAouU0ggREVTQ1JJUFRJT04KVGhlIGNvbmZpZ3VyYXRp b24gZmlsZSBmb3IgdGhlIHNvY2tzIGNsaWVudCBsaWJyYXJ5IGFsbG93IGNvbnRy b2wgb3Zlcgpsb2dnaW5nIGFuZCBzZXJ2ZXIgc2VsZWN0aW9uLiAgSXQgaXMgZGl2 aWRlZCBpbnRvIHR3byBwYXJ0cywKbWlzY2VsbGFuZW91cyBzZXR0aW5ncyBhbmQg cm91dGVzLiAgQSBsaW5lIGNhbiBiZSBjb21tZW50ZWQgdXNpbmcgdGhlCnN0YW5k YXJkIGNvbW1lbnQgY2hhcmFjdGVyIFxmQiNcZlAuCi5TSCBGT1JNQVQKVGhlIG1p c2NlbGxhbmVvdXMgc2V0dGluZ3MgaGF2ZSBhIGtleXdvcmQgZm9sbG93ZWQgYnkg YSBjb2xvbiBhbmQgdGhlCnZhbHVlLgouVFAKXGZCZGVidWdcZlAKU2V0dGluZyB0 aGlzIGZpZWxkIHRvIDEgdHVybnMgb24gZGVidWdnaW5nLgouVFAKXGZCbG9nb3V0 cHV0XGZQClRoaXMgdmFsdWUgY29udHJvbHMgd2hlcmUgdGhlIHNlbmRzIGxvZ291 dHB1dC4gIEl0IGNhbgpiZSBlaXRoZXIgXGZCc3lzbG9nXGZQLCBcZkJzdGRvdXRc ZlAsIFxmQnN0ZGVyclxmUCwgYSBmaWxlbmFtZSwgb3IKYSBjb21iaW5hdGlvbi4K LklQIFxmQnJlc29sdmVwcm90b2NvbFxmUApUaGUgcHJvdG9jb2wgdXNlZCB0byBy ZXNvbHZlIGhvc3RuYW1lcy4KVmFsaWQgdmFsdWVzIGFyZSBcZkJ1ZHBcZlAgKGRl ZmF1bHQpLCBcZkJ0Y3BcZlAgYW5kIFxmQmZha2VcZlAuCi5UUAouU0ggUk9VVEVT ClRoZSByb3V0ZXMgYXJlIHNwZWNpZmllZCB3aXRoIGEgXGZCcm91dGVcZlAga2V5 d29yZC4KSW5zaWRlIGEgcGFpciBvZiBwYXJlbnMgKHt9KSBhIHNldCBvZiBrZXl3 b3JkcyBjb250cm9sIHRoZSBiZWhhdmlvciBvZgp0aGUgcm91dGUuCkVhY2ggXGZC cm91dGVcZlAgY2FuIGNvbnRhaW4KdGhyZWUgYWRkcmVzcyBzcGVjaWZpY2F0aW9u czsgXGZCZnJvbVxmUCwgXGZCdG9cZlAgYW5kIFxmQnZpYVxmUC4KQSByb3V0ZSBp cyBzZWxlY3RlZCBmb3IgYSBjb25uZWN0aW9uIGJhc2VkIG9uIHRoZSB2YWx1ZXMg d2l0aGluIHRoZQpcZkJyb3V0ZVxmUCBibG9jay4gIFRoZSBcZkJyb3V0ZVxmUCBi bG9jayBjYW4gY29udGFpbiB0aGUgZm9sbG93aW5nOgouVFAKLlNIIEFERFJFU1NF UwpFYWNoIGFkZHJlc3MgZmllbGQgY2FuIGNvbnNpc3Qgb2YgYSBpcGFkZHJlc3Mg KGFuZCB3aGVyZSBtZWFuaW5nZnVsLAphIG5ldG1hc2ssIHNlcGFyYXRlZCBmcm9t IHRoZSBpcGFkZHJlc3MgYnkgYSAnXGZCL1xmUCcgc2lnbi4pLCBhIGhvc3RuYW1l LApvciBhIGRvbWFpbm5hbWUgKGRlc2lnbmF0ZWQgYnkgdGhlIGxlYWRpbmcgJ1xm Qi5cZlAnKS4KRWFjaCBhZGRyZXNzIGNhbiBiZSBmb2xsb3dlZCBieSBhIG9wdGlv bmFsIFxmQnBvcnRcZlAgc3BlY2lmaWVyLgoKLklQIFxmQmZyb21cZlAKVGhlIHJv dXRlIGlzIHVzZWQgb25seSBieSByZXF1ZXN0cyBjb21pbmcgZnJvbSB0aGUgYWRk cmVzcyBnaXZlbiBhcyB2YWx1ZS4KLklQIFxmQnRvXGZQClRoZSByb3V0ZSBpcyB1 c2VkIG9ubHkgYnkgcmVxdWVzdHMgZ29pbmcgdG8gdGhlIGFkZHJlc3MgZ2l2ZW4g YXMgdmFsdWUuCi5JUCBcZkJ2aWFcZlAKQWRkcmVzcyBvZiBzb2NrcyBzZXJ2ZXIg dG8gYmUgdXNlZCBmb3IgdGhlIGNvbm5lY3Rpb24uCi5JUCBcZkJwb3J0XGZQClBh cmFtZXRlciB0byBcZkJmcm9tXGZQLCBcZkJ0b1xmUCBhbmQgXGZCdmlhXGZQLiAg QWNjZXB0cyB0aGUga2V5d29yZHMKXGZCZXEvPSwgbmVxLyE9LCBnZS8+PSwgbGUv PD0sIGd0Lz4sIGx0LzxcZlAgZm9sbG93ZWQgYnkgYSBudW1iZXIuCkEgcG9ydHJh bmdlIGNhbiBhbHNvIGJlIGdpdmVuIGFzICJwb3J0IDxzdGFydCAjPiAtIDxlbmQg Iz4iLCB3aGljaAp3aWxsIG1hdGNoIGFsbCBwb3J0IG51bWJlcnMgd2l0aGluIHRo ZSByYW5nZSA8c3RhcnQgIz4gYW5kIDxlbmQgIz4uCi5JUCBcZkJjb21tYW5kXGZQ ClRoZSBzZXJ2ZXIgc3VwcG9ydHMgdGhlIGdpdmVuIGNvbW1hbmRzLiAgVmFsaWQg Y29tbWFuZHMKYXJlIFxmQmJpbmRcZlAsIFxmQmJpbmRyZXBseVxmUCwgXGZCY29u bmVjdFxmUCwgXGZCdWRwYXNzb2NpYXRlXGZQCmFuZCBcZkJ1ZHByZXBseVxmUC4g CmFuZCBcZkJ1ZHByZXBseVxmUC4gIENhbiBiZSB1c2VkIGluc3RlYWQgb2YsIG9y IHRvIGNvbXBsZW1lbnQsClxmQnByb3RvY29sXGZQLgouSVAgXGZCbWV0aG9kXGZQ Ckxpc3Qgb2YgYXV0aGVudGljYXRpb24gbWV0aG9kcyB0aGUgXGZCY2xpZW50XGZQ IHN1cHBvcnRzIGFuZCB3aGljaCB0bwpvZmZlciB0aGUgc2VydmVyLiAgQ3VycmVu dGx5IHN1cHBvcnRlZCB2YWx1ZXMgYXJlIFxmQm5vbmVcZlAgYW5kClxmQnVzZXJu YW1lXGZQLgouSVAgXGZCcHJvdG9jb2xcZlAKVGhlIHByb3RvY29scyB0aGUgc2Vy dmVyIHN1cHBvcnRzLgpTdXBwb3J0ZWQgdmFsdWVzIGFyZSBcZkJ0Y3BcZlAgYW5k IFxmQnVkcFxmUC4KLklQIFxmQnByb3h5cHJvdG9jb2xcZlAKVGhlIHByb3h5IHBy b3RvY29scyB0aGUgc2VydmVyIHN1cHBvcnRzLgpDdXJyZW50bHkgc3VwcG9ydGVk IHZhbHVlcyBhcmUgXGZCc29ja3NfdjRcZlAsIFxmQnNvY2tzX3Y1XGZQLAphbmQg XGZCaHR0cF92MS4wXGZQLgouU0ggRVhBTVBMRVMKU2VlIHRoZSBleGFtcGxlIGRp cmVjdG9yeSBpbiB0aGUgZGlzdHJpYnV0aW9uLgouU0ggRU5WSVJPTk1FTlQKLlRQ ClxmQlNPQ0tTX1VTRVJOQU1FXGZQClVzZSBcZkJTT0NLU19VU0VSTkFNRVxmUCBh cyB0aGUgdXNlcm5hbWUgd2hlbiBkb2luZyB1c2VybmFtZQphdXRoZW50aWNhdGlv bi4KLlRQClxmQlNPQ0tTX1BBU1NXT1JEXGZQClVzZSBcZkJTT0NLU19QQVNTV09S RFxmUCBhcyB0aGUgcGFzc3dvcmQgd2hlbiBkb2luZyB1c2VybmFtZQphdXRoZW50 aWNhdGlvbi4gIE5vdCByZWNvbW1lbmRlZCBhcyBvdGhlciB1c2VycyBvbiB0aGUg c3lzdGVtIAptaWdodCBiZSBhYmxlIHRvIHNlZSB5b3VyIHBhc3N3b3JkLgouU0gg RklMRVMKLkkgL2V0Yy9zb2Nrcy5jb25mCi5TSCBBVVRIT1JTCkZvciBJbmZlcm5v IE5ldHR2ZXJrIEEvUywgTm9yd2F5OgogTWljaGFlbCBTaHVsZG1hbiA8bWljaGFl bHNAaW5ldC5ubz46IERlc2lnbiBhbmQgaW1wbGVtZW50YXRpb24uCiBLYXJsLUFu ZHJlJyBTa2V2aWsgPGthcmxzQGluZXQubm8+OiBBdXRvY29uZiBhbmQgcG9ydGlu Zy4KLlNIIFNFRSBBTFNPCnNvY2tkKDFtKSBzb2NrZC5jb25mKDQpIHNvY2tzaWZ5 KDEpIAouUHAKSW5mb3JtYXRpb24gYWJvdXQgbmV3IHJlbGVhc2VzIGFuZCBvdGhl ciByZWxhdGVkIGlzc3VlcyBjYW4gYmUgZm91bmQKb24gdGhlClxmQkRhbnRlXGZQ CldXVyBob21lIHBhZ2UgYXQgaHR0cDovL3d3dy5pbmV0Lm5vL2RhbnRlLgouU0gg QlVHUwpTZWUgdGhlIGFjY29tcGFueWluZyBCVUdTIGZpbGUuICBOZXcgb25lcyBz aG91bGQgYmUgcmVwb3J0ZWQgdG8KZGFudGVcLWJ1Z3NAaW5ldC5uby4KAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA bWFuL21hbjQvc29ja2QuY29uZi40AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAADAwMDA2MDAAMDQwNzE1NgAwMDAwMDEyADAwMDAwMDMzMTYyADExMTE1NDQ0 NDEwADAwMTUxMDMAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAB1c3RhcgAwMG1uMTMzNzY2AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAc3RhZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwMTQ2 ADAwMDAwMDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuXCIgJElkOiBzb2NrZC5j b25mLjUsdiAxLjcxIDIwMDYvMDEvMjAgMTI6NTk6MDkgbWljaGFlbHMgRXhwICQK LlwiCi5cIiBDb3B5cmlnaHQgKGMpIDE5OTcsIDE5OTgsIDE5OTksIDIwMDAsIDIw MDEsIDIwMDIsIDIwMDMsIDIwMDQKLlwiICAgICAgSW5mZXJubyBOZXR0dmVyayBB L1MsIE5vcndheS4gIEFsbCByaWdodHMgcmVzZXJ2ZWQuCi5cIgouXCIgUmVkaXN0 cmlidXRpb24gYW5kIHVzZSBpbiBzb3VyY2UgYW5kIGJpbmFyeSBmb3Jtcywgd2l0 aCBvciB3aXRob3V0Ci5cIiBtb2RpZmljYXRpb24sIGFyZSBwZXJtaXR0ZWQgcHJv dmlkZWQgdGhhdCB0aGUgZm9sbG93aW5nIGNvbmRpdGlvbnMKLlwiIGFyZSBtZXQ6 Ci5cIiAxLiBUaGUgYWJvdmUgY29weXJpZ2h0IG5vdGljZSwgdGhpcyBsaXN0IG9m IGNvbmRpdGlvbnMgYW5kIHRoZSBmb2xsb3dpbmcKLlwiICAgIGRpc2NsYWltZXIg bXVzdCBhcHBlYXIgaW4gYWxsIGNvcGllcyBvZiB0aGUgc29mdHdhcmUsIGRlcml2 YXRpdmUgd29ya3MKLlwiICAgIG9yIG1vZGlmaWVkIHZlcnNpb25zLCBhbmQgYW55 IHBvcnRpb25zIHRoZXJlb2YsIGFzd2VsbCBhcyBpbiBhbGwKLlwiICAgIHN1cHBv cnRpbmcgZG9jdW1lbnRhdGlvbi4KLlwiIDIuIEFsbCBhZHZlcnRpc2luZyBtYXRl cmlhbHMgbWVudGlvbmluZyBmZWF0dXJlcyBvciB1c2Ugb2YgdGhpcyBzb2Z0d2Fy ZQouXCIgICAgbXVzdCBkaXNwbGF5IHRoZSBmb2xsb3dpbmcgYWNrbm93bGVkZ2Vt ZW50OgouXCIgICAgICBUaGlzIHByb2R1Y3QgaW5jbHVkZXMgc29mdHdhcmUgZGV2 ZWxvcGVkIGJ5Ci5cIiAgICAgIEluZmVybm8gTmV0dHZlcmsgQS9TLCBOb3J3YXku Ci5cIiAzLiBUaGUgbmFtZSBvZiB0aGUgYXV0aG9yIG1heSBub3QgYmUgdXNlZCB0 byBlbmRvcnNlIG9yIHByb21vdGUgcHJvZHVjdHMKLlwiICAgIGRlcml2ZWQgZnJv bSB0aGlzIHNvZnR3YXJlIHdpdGhvdXQgc3BlY2lmaWMgcHJpb3Igd3JpdHRlbiBw ZXJtaXNzaW9uLgouXCIKLlwiIFRISVMgU09GVFdBUkUgSVMgUFJPVklERUQgQlkg VEhFIEFVVEhPUiBgYEFTIElTJycgQU5EIEFOWSBFWFBSRVNTIE9SCi5cIiBJTVBM SUVEIFdBUlJBTlRJRVMsIElOQ0xVRElORywgQlVUIE5PVCBMSU1JVEVEIFRPLCBU SEUgSU1QTElFRCBXQVJSQU5USUVTCi5cIiBPRiBNRVJDSEFOVEFCSUxJVFkgQU5E IEZJVE5FU1MgRk9SIEEgUEFSVElDVUxBUiBQVVJQT1NFIEFSRSBESVNDTEFJTUVE LgouXCIgSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUiBCRSBMSUFCTEUgRk9S IEFOWSBESVJFQ1QsIElORElSRUNULAouXCIgSU5DSURFTlRBTCwgU1BFQ0lBTCwg RVhFTVBMQVJZLCBPUiBDT05TRVFVRU5USUFMIERBTUFHRVMgKElOQ0xVRElORywg QlVUCi5cIiBOT1QgTElNSVRFRCBUTywgUFJPQ1VSRU1FTlQgT0YgU1VCU1RJVFVU RSBHT09EUyBPUiBTRVJWSUNFUzsgTE9TUyBPRiBVU0UsCi5cIiBEQVRBLCBPUiBQ Uk9GSVRTOyBPUiBCVVNJTkVTUyBJTlRFUlJVUFRJT04pIEhPV0VWRVIgQ0FVU0VE IEFORCBPTiBBTlkKLlwiIFRIRU9SWSBPRiBMSUFCSUxJVFksIFdIRVRIRVIgSU4g Q09OVFJBQ1QsIFNUUklDVCBMSUFCSUxJVFksIE9SIFRPUlQKLlwiIChJTkNMVURJ TkcgTkVHTElHRU5DRSBPUiBPVEhFUldJU0UpIEFSSVNJTkcgSU4gQU5ZIFdBWSBP VVQgT0YgVEhFIFVTRSBPRgouXCIgVEhJUyBTT0ZUV0FSRSwgRVZFTiBJRiBBRFZJ U0VEIE9GIFRIRSBQT1NTSUJJTElUWSBPRiBTVUNIIERBTUFHRS4KLlwiCi5cIiBJ bmZlcm5vIE5ldHR2ZXJrIEEvUyByZXF1ZXN0cyB1c2VycyBvZiB0aGlzIHNvZnR3 YXJlIHRvIHJldHVybiB0bwouXCIKLlwiICBTb2Z0d2FyZSBEaXN0cmlidXRpb24g Q29vcmRpbmF0b3IgIG9yICBzZGNAaW5ldC5ubwouXCIgIEluZmVybm8gTmV0dHZl cmsgQS9TCi5cIiAgT3NsbyBSZXNlYXJjaCBQYXJrCi5cIiAgR2F1c3RhZGFsbOll biAyMQouXCIgIE5PLTAzNDkgT3NsbwouXCIgIE5vcndheQouXCIKLlwiIGFueSBp bXByb3ZlbWVudHMgb3IgZXh0ZW5zaW9ucyB0aGF0IHRoZXkgbWFrZSBhbmQgZ3Jh bnQgSW5mZXJubyBOZXR0dmVyayBBL1MKLlwiIHRoZSByaWdodHMgdG8gcmVkaXN0 cmlidXRlIHRoZXNlIGNoYW5nZXMuCi5cIgouVEggU09DS0QuQ09ORiA1ICJNYXkg MTEsIDIwMDEiCi5TSCBOQU1FCnNvY2tkLmNvbmYgXC0gXGZCRGFudGVcZlAgc2Vy dmVyIGNvbmZpZ3VyYXRpb24gZmlsZSBzeW50YXgKLlNIIERFU0NSSVBUSU9OClRo ZSBjb25maWd1cmF0aW9uIGZpbGUgZm9yIHRoZSBcZkJEYW50ZVxmUCBzZXJ2ZXIg Y29udHJvbHMgYm90aCBhY2Nlc3MKY29udHJvbHMgYW5kIGxvZ2dpbmcuICBJdCBp cyBkaXZpZGVkIGludG8gdGhyZWUgcGFydHM7IHNlcnZlciBzZXR0aW5ncywKcnVs ZXMsIGFuZCByb3V0ZXMuICBBIGxpbmUgY2FuIGJlIGNvbW1lbnRlZCB1c2luZyB0 aGUgc3RhbmRhcmQgY29tbWVudApjaGFyYWN0ZXIgXGZCI1xmUC4KLlNIIFNFUlZF UiBTRVRUSU5HUwpUaGUgc2VydmVyIHNldHRpbmdzIGNvbnRyb2wgdGhlIGdlbmVy aWMgYmVoYXZpb3VyIG9mIHRoZSBzZXJ2ZXIuICBFYWNoCmtleXdvcmQgaXMgc2Vw YXJhdGVkIGZyb20gaXQncyB2YWx1ZSBieSBhIFxmQic6J1xmUCBjaGFyYWN0ZXIu Ci5cIiAuSVAgXGZCY2hpbGQubWF4aWRsZVxmUAouXCIgTWFpbnRhaW5zIGEgbWF4 aW11bSBvbiBob3cgbWFueSBjaGlsZHJlbiBvZiBlYWNoIHR5cGUgY2FuIHJlbWFp bgouXCIgaWRsZS4gIFVzZWQgdG8gcmVkdWNlIHRoZSBhbW91bnQgb2YgaWRsZSBw cm9jZXNzZXMgYWZ0ZXIgYSAiY2xpZW50IGJ1cnN0IgouXCIgaGFzIG9jY3VyZWQu ICBUaGUgZGVmYXVsdCBpcyBcZkIwXGZQIChubyBtYXhpbXVtKS4KLklQIFxmQmNv bXBhdGliaWxpdHlcZlAKV2l0aCB0aGUgXGZCc2FtZXBvcnRcZlAga2V5d29yZCwg dGhlIHNlcnZlciBhdHRlbXB0cyB0byB1c2UgdGhlIHNhbWUKcG9ydCBvbiB0aGUg c2VydmVyIGFuZCB0aGUgY2xpZW50LiAgVGhpcyBmdW5jdGlvbmFsaXR5IGlzIHRo ZSBkZWZhdWx0LCBidXQKd2hlbiB0aGlzIG9wdGlvbiBpcyBnaXZlbiBpdCB3aWxs IGFsc28gYmUgZG9uZSB3aXRoIHByaXZpbGVnZWQgcG9ydHMuClRoZSBcZkJyZXVz ZWFkZHJcZlAga2V5d29yZCBtaWdodCBzb2x2ZSBwcm9ibGVtcyB3aGVuIHRoZQpi aW5kIGV4dGVuc2lvbiBpcyB1c2VkIGJ1dCB0aGUgZWZmZWN0cyBvZiBlbmFibGlu ZyBcZkJyZXVzZWFkZHJcZlAKaXMgY3VycmVudGx5IHVua25vd24sIGRvIG5vdCBl bmFibGUgaXQgdW5sZXNzIHlvdSB1bmRlcnN0YW5kCnRoZSBlZmZlY3RzLgouSVAg XGZCY29ubmVjdHRpbWVvdXRcZlAKVGhlIG51bWJlciBvZiBzZWNvbmRzIGEgY2xp ZW50IGhhcyB0byBzZW5kIHRoZSByZXF1ZXN0IGFmdGVyIGEgY29ubmVjdC4KU2V0 IGl0IHRvIDAgZm9yIGZvcmV2ZXIuCi5JUCBcZkJleHRlcm5hbFxmUApUaGUgYWRk cmVzcyB0byBiZSB1c2VkIGZvciBvdXRnb2luZyBjb25uZWN0aW9ucy4KVGhlIGFk ZHJlc3MgZ2l2ZW4gbWF5IGJlIGVpdGhlciBhIElQIGFkZHJlc3Mgb3IgYSBpbnRl cmZhY2VuYW1lLgpDYW4gYmUgZ2l2ZW4gbXVsdGlwbGUgdGltZXMgZm9yIGRpZmZl cmVudCBhZGRyZXNzZXMuCi5JUCBcZkJleHRlcm5hbC5yb3RhdGlvblxmUApJZiBt b3JlIHRoYW4gb25lIGV4dGVybmFsIGFkZHJlc3MgaXMgZ2l2ZW4sIHRoaXMgZ292 ZXJucyB3aGljaAphZGRyZXNzIGlzIHNlbGVjdGVkLiAgVmFsaWQgdmFsdWVzIGFy ZSBcZkJub25lXGZQICh0aGUgZGVmYXVsdCkgYW5kClxmQnJvdXRlXGZQLiAgVGhl IGxhdHRlciBtaWdodCByZXF1aXJlIHlvdSB0byBzZXQgXGZCdXNlci5wcml2aWxl Z2VkXGZQIHRvClxmQnJvb3RcZlAuCgpOb3RlIHRoYXQgXGZCcm91dGVcZlAgbWln aHQgY3JlYXRlIHByb2JsZW1zIGZvcgpmdHAtY2xpZW50cyB1c2luZyBhY3RpdmUg ZnRwIGlmIHRoZSBcZkJEYW50ZVxmUCBiaW5kIGV4dGVuc2lvbgppcyBlbmFibGVk IGZvciB0aGUgZnRwLWNsaWVudC4KLklQIFxmQmludGVybmFsXGZQClRoZSBpbnRl cm5hbCBhZGRyZXNzZXMuICBDb25uZWN0aW9ucyB3aWxsIG9ubHkgYmUgYWNjZXB0 ZWQgb24gdGhlc2UgYWRkcmVzc2VzLgpUaGUgYWRkcmVzcyBnaXZlbiBtYXkgYmUg ZWl0aGVyIGEgSVAgYWRkcmVzcyBvciBhIGludGVyZmFjZW5hbWUuCi5JUCBcZkJp b3RpbWVvdXRcZlAKVGhlIG51bWJlciBvZiBzZWNvbmRzIGFuIGVzdGFibGlzaGVk IGNvbm5lY3Rpb24gY2FuIGJlIGlkbGUuICBTZXQgaXQKdG8gMCBmb3IgZm9yZXZl ci4KLklQIFxmQmxvZ291dHB1dFxmUApUaGlzIHZhbHVlIGNvbnRyb2xzIHdoZXJl IHRoZSBzZXJ2ZXIgc2VuZHMgbG9nb3V0cHV0LiAgSXQgY2FuCmJlIGVpdGhlciBc ZkJzeXNsb2dcZlBbL1xmQmZhY2lsaXR5XGZQXSwgXGZCc3Rkb3V0XGZQLCBcZkJz dGRlcnJcZlAsCmEgZmlsZW5hbWUsIG9yIGEgY29tYmluYXRpb24uCi5JUCBcZkJt ZXRob2RcZlAKQSBsaXN0IG9mIGFjY2VwdGFibGUgYXV0aGVudGljYXRpb24gbWV0 aG9kcyBmb3Igc29ja3MtcnVsZXMsIGluIG9yZGVyCm9mIHByZWZlcmVuY2UuClN1 cHBvcnRlZCB2YWx1ZXMgYXJlIFxmQnVzZXJuYW1lXGZQLCBcZkJub25lXGZQLCBc ZkJyZmM5MzFcZlAgYW5kIFxmQnBhbVxmUC4KVGhpcyBsaXN0IGlzIHVzZWQgYXMg dGhlIGRlZmF1bHQgZm9yIGFsbCBjb21pbmcgcnVsZXMgdW50aWwKY2hhbmdlZC4g IFRoZW4gdGhlIGNoYW5nZWQgbGlzdCBpcyB1c2VkIGFzIHRoZSBkZWZhdWx0IGZv cgp0aGUgbmV4dCBydWxlcy4KCklmIGEgbWV0aG9kIGlzIG5vdCBzZXQgaW4gdGhp cyBsaXN0IGl0IHdpbGwgbmV2ZXIgYmUgc2VsZWN0ZWQuCgpTZWUgdGhlIHNlY3Rp b24gb24gbWV0aG9kcyBmb3IgYSBleHBsYW5hdGlvbiBvZiB0aGUgZGlmZmVyZW50 IG1ldGhvZHMuCgouSVAgXGZCY2xpZW50bWV0aG9kXGZQCkEgbGlzdCBvZiBhY2Nl cHRhYmxlIGF1dGhlbnRpY2F0aW9uIG1ldGhvZHMgZm9yIGNsaWVudC1ydWxlcywK aW4gb3JkZXIgb2YgcHJlZmVyZW5jZS4gIFRoZXNlIGFyZSB0aGUgYXV0aGVudGlj YXRpb25tZXRob2RzCnRoYXQgY2FuIHByb3ZpZGUgYXV0aGVudGljYXRpb25zIGJh c2VkIG9uIGp1c3QgdGhlIGNsaWVudCdzClRDUCBjb25uZWN0aW9uLgpTdXBwb3J0 ZWQgdmFsdWVzIGFyZSBcZkJub25lXGZQLCBcZkJyZmM5MzFcZlAgYW5kIFxmQnBh bVxmUC4KVGhpcyBsaXN0IGlzIHVzZWQgYXMgdGhlIGRlZmF1bHQgZm9yIGFsbCBj b21pbmcgcnVsZXMgdW50aWwKY2hhbmdlZC4gIFRoZW4gdGhlIGNoYW5nZWQgbGlz dCBpcyB1c2VkIGFzIHRoZSBkZWZhdWx0IGZvcgp0aGUgbmV4dCBydWxlcy4gIFRo ZSBkZWZhdWx0IHZhbHVlIGlzIFxmQm5vbmVcZlAuCgpJZiBhIG1ldGhvZCBpcyBu b3Qgc2V0IGluIHRoaXMgbGlzdCBpdCB3aWxsIG5ldmVyIGJlIHNlbGVjdGVkLgoK LklQIFxmQnNyY2hvc3RcZlAKV2l0aCB0aGUgXGZCbm9taXNtYXRjaFxmUCBrZXl3 b3JkLCB0aGUgc2VydmVyIHdpbGwgbm90IGFjY2VwdApjb25uZWN0cyBmcm9tIGFk ZHJlc3NlcyBoYXZpbmcgYSBtaXNtYXRjaCBiZXR3ZWVuIEROUyBhZGRyZXNzIGFu ZCBob3N0bmFtZS4KRGVmYXVsdCBpcyB0byBhY2NlcHQgdGhlbS4KV2l0aCB0aGUg XGZCbm91bmtub3duXGZQIGtleXdvcmQsIHRoZSBzZXJ2ZXIgd2lsbCBub3QgYWNj ZXB0IGNvbm5lY3RzCmZyb20gYWRkcmVzc2VzIHdpdGhvdXQgYSBETlMgcmVjb3Jk LiAgRGVmYXVsdCBpcyB0byBhY2NlcHQgdGhlbS4KCi5JUCBcZkJ1c2VyLnByaXZp bGVnZWRcZlAKVXNlcm5hbWUgd2hpY2ggd2lsbCBiZSB1c2VkIGZvciBkb2luZyBw cml2aWxlZ2VkIG9wZXJhdGlvbnMuCi5JUCBcZkJ1c2VyLm5vdHByaXZpbGVnZWRc ZlAKVXNlciB3aGljaCB0aGUgc2VydmVyIHJ1bnMgYXMgbW9zdCBvZiB0aGUgdGlt ZS4KLklQIFxmQnVzZXIubGlid3JhcFxmUApVc2VyIHVzZWQgdG8gZXhlY3V0ZSBs aWJ3cmFwIGNvbW1hbmRzLgoKLlNIIE1PRFVMRVMKVGhlIGZvbGxvd2luZyBtb2R1 bGVzIGFyZSBzdXBwb3J0ZWQgYnkgXGZCRGFudGVcZlAuICBNb2R1bGVzIGFyZSBw dXJjaGFzZWQKc2VwYXJhdGVseSBmcm9tIEluZmVybm8gTmV0dHZlcmsgQS9TLiAg U2VlIHRoZSBcZkJEYW50ZVxmUCBob21lcGFnZQpmb3IgbW9yZSBpbmZvcm1hdGlv bi4KCi5JUCBcZkJiYW5kd2lkdGhcZlAKVGhlIFxmQmJhbmR3aWR0aFxmUCBtb2R1 bGUgZ2l2ZXMgeW91IGNvbnRyb2wgb3ZlciBob3cgbXVjaApiYW5kd2lkdGggdGhl IERhbnRlIHNlcnZlciB1c2VzIG9uIGJlaGFsZiBvZiBkaWZmZXJlbnQgY2xpZW50 cy4KCi5JUCBcZkJyZWRpcmVjdFxmUApUaGUgXGZCcmVkaXJlY3RcZlAgbW9kdWxl IGdpdmVzIHlvdSBjb250cm9sIG92ZXIgd2hhdCBhZGRyZXNzZXMgdGhlCnNlcnZl ciB3aWxsIHVzZSBvbiBiZWhhbGYgb2YgdGhlIGNsaWVudCBhbmQgYWxsb3dzIHlv dSB0byBib3RoCnJlZGlyZWN0IGNsaWVudCByZXF1ZXN0cyB0byBhIGRpZmZlcmVu dCBhZGRyZXNzZXMgYXN3ZWxsIGFzIGNvbnRyb2wKdGhlIHJhbmdlIG9mIGFkZHJl c3NlcyBhbmQgcG9ydHMgdG8gYmUgdXNlZCBvbiBiZWhhbGYgb2YgdGhlIGNsaWVu dC4KCi5JUCBcZkJzZXNzaW9uXGZQClRoZSBcZkJzZXNzaW9uXGZQIG1vZHVsZSBn aXZlcyB5b3UgY29udHJvbCBvdmVyIHRoZSBudW1iZXIgb2YKc2Vzc2lvbnMgdGhh dCBjYW4gYmUgY3JlYXRlZCBieSBkaWZmZXJlbnQgc29ja3MgdXNlcnMuCgoKLlNI IE1FVEhPRFMKVGhlIFxmQkRhbnRlXGZQIHNlcnZlciBzdXBwb3J0cyB0aGUgZm9s bG93aW5nIG1ldGhvZHMuICBTb21lCmluc3RhbGxhdGlvbnMgb2YgXGZCRGFudGVc ZlAgbWF5IHN1cHBvcnQgb25seSBhIHN1YnNldCBvZiB0aGVzZS4KCi5JUCBcZkJu b25lXGZQClRoZSBtZXRob2QgcmVxdWlyZXMgbm8gZm9ybSBvZiBhdXRoZW50aWNh dGlvbi4KLklQIFxmQnVzZXJuYW1lXGZQClRoZSBtZXRob2QgcmVxdWlyZXMgdGhl IGNsaWVudCB0byBwcm92aWRlIGEgdXNlcm5hbWUgYW5kIHBhc3N3b3JkLgpUaGlz IG11c3QgbWF0Y2ggdGhlIHVzZXJuYW1lIGFuZCBwYXNzd29yZCBnaXZlbiBpbiB0 aGUgc3lzdGVtCnBhc3N3b3JkZmlsZS4KLklQIFxmQnJmYzkzMVxmUApUaGUgbWV0 aG9kIHJlcXVpcmVzIHRoZSBjbGllbnQgaG9zdCB0byBwcm92aWRlIGEgcmZjOTMx ICgiaWRlbnQiKQpyZXBseSBmb3IgdGhlIGNvbm5lY3RpbmcgY2xpZW50LiAgVGhl IG5hbWUgZ2l2ZW4gaW4gdGhlIHJlcGx5Cm11c3QgYmUgcHJlc2VudCBpbiB0aGUg cGFzc3dvcmQgZGF0YWJhc2UuCi5JUCBcZkJwYW1cZlAKVGhlIG1ldGhvZCByZXF1 aXJlcyB0aGUgYXZhaWxhYmxlIGNsaWVudGRhdGEgdG8gbWF0Y2ggYWdhaW5zdCB0 aGUKcGFtIGRhdGFiYXNlLgoKCi5TSCBBRERSRVNTRVMKRWFjaCBhZGRyZXNzIGZp ZWxkIGNhbiBjb25zaXN0IG9mIGEgSVAgYWRkcmVzcyAoYW5kIHdoZXJlIG1lYW5p bmdmdWwsCmEgbmV0bWFzaywgc2VwYXJhdGVkIGZyb20gdGhlIElQIGFkZHJlc3Mg YnkgYSAnXGZCL1xmUCcgc2lnbi4pLCBhIGhvc3RuYW1lLApvciBhIGRvbWFpbm5h bWUgKGRlc2lnbmF0ZWQgc28gYnkgdGhlIGxlYWRpbmcgJ1xmQi5cZlAnKS4KRWFj aCBhZGRyZXNzIGNhbiBiZSBmb2xsb3dlZCBieSBhIG9wdGlvbmFsIFxmQnBvcnRc ZlAgc3BlY2lmaWVyLgouU0ggUlVMRVMKVGhlcmUgYXJlIHR3byBzZXRzIG9mIHJ1 bGVzIGFuZCB0aGV5IHdvcmsgYXQgZGlmZmVyZW50IGxldmVscy4KUnVsZXMgcHJl Zml4ZWQgd2l0aCBcZkJjbGllbnRcZlAgYXJlIGNoZWNrZWQgZmlyc3QgYW5kIGFy ZSB1c2VkIHRvCnNlZSBpZiB0aGUgY2xpZW50IGlzIGFsbG93ZWQgdG8gY29ubmVj dCB0byB0aGUgXGZCRGFudGVcZlAgc2VydmVyLgpXZSB3aWxsIGNhbGwgdGhlbSAi Y2xpZW50LXJ1bGVzIi4KSXQgaXMgZXNwZWNpYWxseSBpbXBvcnRhbnQgdGhhdCB0 aGVzZSBkbyBub3QgdXNlIGhvc3RuYW1lcwpidXQgb25seSBJUCBhZGRyZXNzZXMs IGJvdGggZm9yIHNlY3VyaXR5IGFuZCBwZXJmb3JtYW5jZSByZWFzb25zLgpUaGVz ZSBydWxlcyB3b3JrIGF0IHRoZSBUQ1AvSVAgbGV2ZWwuCgpUaGUgb3RoZXIgcnVs ZXMsIHdoaWNoIHdlIHdpbGwgY2FsbCAic29ja3MtcnVsZXMiIGFyZSBhIGxldmVs IGhpZ2hlcgphbmQgYXJlIGNoZWNrZWQgYWZ0ZXIgdGhlIGNsaWVudCBjb25uZWN0 aW9uIGhhcyBiZWVuIGFjY2VwdGVkIGJ5IHRoZQpjbGllbnQtcnVsZXMuICBUaGUg c29ja3MtcnVsZXMgYXJlIHVzZWQgdG8gZXZhbHVhdGUgdGhlIHNvY2tzIHJlcXVl c3QKdGhhdCB0aGUgY2xpZW50IHNlbmRzLiAgVGhleSB0aHVzIHdvcmsgYXQgdGhl IHNvY2tzIHByb3RvY29sIGxldmVsLgoKQm90aCBzZXQgb2YgcnVsZXMgc3RhcnQg d2l0aCBhIFxmQnBhc3NcZlAvXGZCZGVueVxmUCBrZXl3b3JkICh0aGUKY2xpZW50 LXJ1bGVzIGhhdmUgImNsaWVudCIgcHJlZml4ZWQgdG8gdGhlIFxmQnBhc3NcZlAv XGZCZGVueVxmUAprZXl3b3JkKSB3aGljaCBkZXRlcm1pbmVzIGlmIGNvbm5lY3Rp b25zIG1hdGNoaW5nIHRoZSBydWxlIGFyZSB0bwpwYXNzIG9yIGJlIGJsb2NrZWQu ICBCb3RoIHNldCBvZiBydWxlcyBhbHNvIHNwZWNpZnkgYSBcZkJmcm9tXGZQL1xm QnRvXGZQCmFkZHJlc3MgcGFpciB3aGljaCBnaXZlcyB0aGUgYWRkcmVzc2VzIHRo ZSBydWxlIHdpbGwgbWF0Y2guCgpJbiBib3RoIGNvbnRleHRzLCBcZkJmcm9tXGZQ IG1lYW5zIHRoZSBjbGllbnRzIGFkZHJlc3MuCgpJbiB0aGUgY2xpZW50LXJ1bGUg Y29udGV4dCwgXGZCdG9cZlAgbWVhbnMgdGhlIGFkZHJlc3MgdGhlIHJlcXVlc3QK aXMgYWNjZXB0ZWQgb24sIGkuZS4gdGhlIGFkZHJlc3MgdGhlIFxmQkRhbnRlXGZQ IHNlcnZlciBsaXN0ZW5zCm9uLgoKSW4gdGhlIHNvY2tzLXJ1bGUgY29udGV4dCwg XGZCdG9cZlAgbWVhbnMgdGhlIGNsaWVudCdzIGRlc3RpbmF0aW9uIGFkZHJlc3Ms CmFzIGZvcm11bGF0ZWQgaW4gdGhlIGNsaWVudCdzIHByb3h5IHJlcXVlc3QuCgpJ biBhZGRpdGlvbiB0byB0aGUgYWRkcmVzc2VzIHRoZXJlIGlzIGEgc2V0IG9mIG9w dGlvbmFsIGtleXdvcmRzIHdoaWNoCmNhbiBiZSBnaXZlbi4gIFRoZXJlIGFyZSB0 d28gZm9ybXMgb2Yga2V5d29yZHMsIGNvbmRpdGlvbnMgYW5kCmFjdGlvbnMuICBG b3IgZWFjaCBydWxlLCBhbGwgY29uZGl0aW9ucyBhcmUgY2hlY2tlZCBhbmQgaWYg dGhleQptYXRjaCB0aGUgcmVxdWVzdCwgdGhlIGFjdGlvbnMgYXJlIGV4ZWN1dGVk LgoKVGhlIGxpc3Qgb2YgY29uZGl0aW9uIGtleXdvcmRzIGlzOgpcZkJmcm9tXGZQ LCBcZkJ0b1xmUCwgXGZCY29tbWFuZFxmUCwgXGZCbWV0aG9kXGZQLApcZkJwcm90 b2NvbFxmUCwgXGZCcHJveHlwcm90b2NvbFxmUCwgXGZCdXNlclxmUC4KClRoZSBs aXN0IG9mIGFjdGlvbnMga2V5d29yZHMgaXM6IFxmQmJhbmR3aWR0aFxmUCwgXGZC bGlid3JhcFxmUCwKXGZCbG9nXGZQIGFuZCBcZkJyZWRpcmVjdFxmUC4KClRoZSBm b3JtYXQgYW5kIGNvbnRlbnQgb2YgdGhlIHJ1bGVzIGlzIGlkZW50aWNhbCwgYnV0 IGNsaWVudC1ydWxlcwptYXkgY29udGFpbiBvbmx5IGEgc3Vic2V0IG9mIHRoZSBz b2Nrcy1ydWxlcy4gIE1vcmUgY29uY3JldGUsIHRoZXkKbWF5IG5vdCBjb250YWlu IGFueSBrZXl3b3JkcyByZWxhdGVkIHRvIHRoZSBzb2NrcyBwcm90b2NvbC4KCi5J UApUaGUgY29udGVudHMgb2YgYSBjbGllbnQtcnVsZSBpczoKCi5JUCBcZkJmcm9t XGZQClRoZSBydWxlIGFwcGxpZXMgdG8gcmVxdWVzdHMgY29taW5nIGZyb20gdGhl IGFkZHJlc3MgZ2l2ZW4gYXMgdmFsdWUuCi5JUCBcZkJ0b1xmUApUaGUgcnVsZSBh cHBsaWVzIHRvIHJlcXVlc3RzIGdvaW5nIHRvIHRoZSBhZGRyZXNzIGdpdmVuIGFz IHZhbHVlLgouSVAgXGZCcG9ydFxmUApQYXJhbWV0ZXIgdG8gXGZCZnJvbVxmUCwg XGZCdG9cZlAgYW5kIFxmQnZpYVxmUC4gIEFjY2VwdHMgdGhlIGtleXdvcmRzClxm QmVxLz0sIG5lcS8hPSwgZ2UvPj0sIGxlLzw9LCBndC8+LCBsdC88XGZQIGZvbGxv d2VkIGJ5IGEgbnVtYmVyLgpBIHBvcnRyYW5nZSBjYW4gYWxzbyBiZSBnaXZlbiBh cyAicG9ydCA8c3RhcnQgIz4gLSA8ZW5kICM+Iiwgd2hpY2gKd2lsbCBtYXRjaCBh bGwgcG9ydCBudW1iZXJzIHdpdGhpbiB0aGUgcmFuZ2UgPHN0YXJ0ICM+IGFuZCA8 ZW5kICM+LgouSVAgXGZCbGlid3JhcFxmUApUaGUgc2VydmVyIHdpbGwgcGFzcyB0 aGUgbGluZSB0byBsaWJ3cmFwIGZvciBleGVjdXRpb24uCi5JUCBcZkJsb2dcZlAK VXNlZCB0byBjb250cm9sIGxvZ2dpbmcuICBBY2NlcHRlZCBrZXl3b3JkcyBhcmUg XGZCY29ubmVjdFxmUCwKXGZCZGlzY29ubmVjdFxmUCwgXGZCZGF0YVxmUCwgXGZC ZXJyb3JcZlAgYW5kIFxmQmlvb3BlcmF0aW9uXGZQLgouSVAgXGZCdXNlclxmUApU aGUgc2VydmVyIHdpbGwgb25seSBhY2NlcHQgY29ubmVjdGlvbnMgZnJvbSB1c2Vy cyBtYXRjaGluZyBvbmUKb2YgdGhlIG5hbWVzIGdpdmVuIGFzIHZhbHVlLgpJZiBu byBcZkJ1c2VyXGZQIHZhbHVlIGlzIGdpdmVuLCBldmVyeW9uZSBpbiB0aGUgcGFz c3dvcmRmaWxlCndpbGwgYmUgbWF0Y2hlZC4KVGhlIHJ1bGUgbXVzdCBhbHNvIGFs bG93IHVzZXJuYW1lYmFzZWQgbWV0aG9kcy4KLklQIFxmQm1ldGhvZFxmUApSZXF1 aXJlIHRoYXQgdGhlIGNvbm5lY3Rpb24gYmUgImF1dGhlbnRpY2F0ZWQiIHVzaW5n IG9uZSBvZiB0aGUKZ2l2ZW4gbWV0aG9kcy4KLklQIFxmQnBhbS5zZXJ2aWNlbmFt ZVxmUApXaGljaCBzZXJ2aWNlbmFtZSB0byB1c2Ugd2hlbiBpbnZvbHZpbmcgcGFt LiAgRGVmYXVsdCBpcyAic29ja2QiLgoKLklQClRoZSBjb250ZW50cyBvZiBhIHNv Y2tzLXJ1bGUgaXM6CgouSVAgXGZCZnJvbVxmUApUaGUgcnVsZSBhcHBsaWVzIHRv IHJlcXVlc3RzIGNvbWluZyBmcm9tIHRoZSBhZGRyZXNzIGdpdmVuIGFzIHZhbHVl LgouSVAgXGZCdG9cZlAKVGhlIHJ1bGUgYXBwbGllcyB0byByZXF1ZXN0cyBnb2lu ZyB0byBvciB1c2luZyB0aGUgYWRkcmVzcyBnaXZlbiBhcyB2YWx1ZS4KTm90ZSB0 aGF0IHRoZSBtZWFuaW5nIG9mIHRoaXMgYWRkcmVzcyBpcyBhZmZlY3RlZCBieSBc ZkJjb21tYW5kXGZQLgouSVAgXGZCcG9ydFxmUApQYXJhbWV0ZXIgdG8gXGZCZnJv bVxmUCwgXGZCdG9cZlAgYW5kIFxmQnZpYVxmUC4gIEFjY2VwdHMgdGhlIGtleXdv cmRzClxmQmVxLz0sIG5lcS8hPSwgZ2UvPj0sIGxlLzw9LCBndC8+LCBsdC88XGZQ IGZvbGxvd2VkIGJ5IGEgbnVtYmVyLgpBIHBvcnRyYW5nZSBjYW4gYWxzbyBiZSBn aXZlbiBhcyAicG9ydCA8c3RhcnQgIz4gLSA8ZW5kICM+Iiwgd2hpY2gKd2lsbCBt YXRjaCBhbGwgcG9ydCBudW1iZXJzIHdpdGhpbiB0aGUgcmFuZ2UgPHN0YXJ0ICM+ IGFuZCA8ZW5kICM+LgoKLklQIFxmQmJhbmR3aWR0aFxmUApUaGUgY2xpZW50cyBt YXRjaGluZyB0aGlzIHJ1bGUgd2lsbCBhbGwgc2hhcmUgdGhpcyBhbW91bnQgb2Yg YmFuZHdpZHRoLgouSVAgXGZCY29tbWFuZFxmUApUaGUgcnVsZSBhcHBsaWVzIHRv IHRoZSBnaXZlbiBjb21tYW5kcy4gIFZhbGlkIGNvbW1hbmRzCmFyZSBcZkJiaW5k XGZQLCBcZkJiaW5kcmVwbHlcZlAsIFxmQmNvbm5lY3RcZlAsIFxmQnVkcGFzc29j aWF0ZVxmUAphbmQgXGZCdWRwcmVwbHlcZlAuICBDYW4gYmUgdXNlZCBpbnN0ZWFk IG9mLCBvciB0byBjb21wbGVtZW50LApcZkJwcm90b2NvbFxmUC4KLklQIFxmQmxp YndyYXBcZlAKVGhlIHNlcnZlciB3aWxsIHBhc3MgdGhlIGxpbmUgdG8gbGlid3Jh cCBmb3IgZXhlY3V0aW9uLgouSVAgXGZCbG9nXGZQClVzZWQgdG8gY29udHJvbCBs b2dnaW5nLiAgQWNjZXB0ZWQga2V5d29yZHMgYXJlIFxmQmNvbm5lY3RcZlAsClxm QmRpc2Nvbm5lY3RcZlAsIFxmQmRhdGFcZlAgYW5kIFxmQmlvb3BlcmF0aW9uXGZQ LgouSVAgXGZCbWV0aG9kXGZQClJlcXVpcmUgdGhhdCB0aGUgY29ubmVjdGlvbiBi ZSBlc3RhYmxpc2hlZCB1c2luZyBvbmUgb2YgdGhlCmdpdmVuIG1ldGhvZHMuICBc ZkJtZXRob2RcZlAgYWx3YXlzIHJlZmVycyB0byB0aGUgc291cmNlIHBhcnQgb2YK dGhlIHJ1bGUuClZhbGlkIHZhbHVlcyBhcmUgdGhlIHNhbWUgYXMgaW4gdGhlIGds b2JhbCBcZkJtZXRob2RcZlAgbGluZS4KLklQIFxmQnBhbS5zZXJ2aWNlbmFtZVxm UApXaGF0IHNlcnZpY2VuYW1lIHRvIHVzZSB3aGVuIGludm9sdmluZyBwYW0uICBE ZWZhdWx0IGlzICJzb2NrZCIuCi5JUCBcZkJwcm90b2NvbFxmUApUaGUgcnVsZSBh cHBsaWVzIHRvIHRoZSBnaXZlbiBwcm90b2NvbHMuICBWYWxpZCB2YWx1ZXMgYXJl ClxmQnRjcFxmUCBhbmQgXGZCdWRwXGZQLiAgSXQgaXMgcmVjb21tZW5kZWQgdGhh dCB0aGUgXGZCY29tbWFuZFxmUApmb3JtIGlzIHVzZWQgc2luY2UgaXQgcHJvdmlk ZXMgbW9yZSBhY2N1cmFjeSBpbiBkZWZpbmluZyBydWxlcy4KLklQIFxmQnByb3h5 cHJvdG9jb2xcZlAKVGhlIHJ1bGUgYXBwbGllcyB0byByZXF1ZXN0cyB1c2luZyB0 aGUgZ2l2ZW4gcHJveHlwcm90b2NvbC4KVmFsaWQgcHJveHlwcm90b2NvbHMgYXJl IFxmQnNvY2tzX3Y0XGZQIGFuZCBcZkJzb2Nrc192NVxmUC4KLklQIFxmQnJlZGly ZWN0XGZQClRoZSBzb3VyY2UgYW5kL29yIGRlc3RpbmF0aW9uIGNhbiBiZSByZWRp cmVjdGVkIHVzaW5nIHRoZQpcZkJyZWRpcmVjdFxmUCBzdGF0ZW1lbnQuICBUaGUg c3ludGF4IG9mIHRoZSBzdGF0ZW1lbnQgaXMKYXMgZm9sbG93czoKCi5EMQpcZkJy ZWRpcmVjdFxmUCBmcm9tOiBcZkJBRERSRVNTXGZQCgouRDEKXGZCcmVkaXJlY3Rc ZlAgdG86IFxmQkFERFJFU1NcZlAKClRoZSBzZW1hbnRpY3Mgb2YgXGZCZnJvbVxm UCBhbmQgXGZCdG9cZlAgdmFyeSBhY2NvcmRpbmcgdG8KXGZCY29tbWFuZFxmUCBh bmQgc2hvdWxkIGJlIGludHVpdGl2ZSBlbm91Z2guCgouSVAgXGZCdXNlclxmUApU aGUgc2VydmVyIHdpbGwgYWNjZXB0IGNvbm5lY3Rpb25zIGZyb20gdXNlcnMgbWF0 Y2hpbmcgb25lCm9mIHRoZSBuYW1lcyBnaXZlbiBhcyB2YWx1ZS4KSWYgbm8gXGZC dXNlclxmUCB2YWx1ZSBpcyBnaXZlbiwgZXZlcnlvbmUgaW4gdGhlIHBhc3N3b3Jk ZmlsZQp3aWxsIGJlIG1hdGNoZWQuClRoZSBydWxlIG11c3QgaW4gdGhpcyBjYXNl IGFsc28gYWxsb3cgdXNlcm5hbWViYXNlZCBtZXRob2RzLgouU0ggUk9VVEVTClRo ZSByb3V0ZXMgYXJlIHNwZWNpZmllZCB3aXRoIGEgXGZCcm91dGVcZlAga2V5d29y ZC4KSW5zaWRlIGEgcGFpciBvZiBwYXJlbnMgKHt9KSBhIHNldCBvZiBrZXl3b3Jk cyBjb250cm9sIHRoZSBiZWhhdmlvciBvZgp0aGUgcm91dGUuICBTZWUgc29ja3Mu Y29uZig1KSBmb3IgYSBkZXNjcmlwdGlvbi4gIFRoaXMgaXMgdXNlZCB0bwpwZXJm b3JtIHNvLWNhbGxlZCAic2VydmVyLWNoYWluaW5nIiwgd2hlcmUgb25lIHNvY2tz LXNlcnZlciBjb25uZWN0cwp0byBhbm90aGVyIHNvY2tzLXNlcnZlciBmdXRoZXIg dXBzdHJlYW0uICAKLlNIIEVYQU1QTEVTClNlZSB0aGUgZXhhbXBsZSBkaXJlY3Rv cnkgaW4gdGhlIGRpc3RyaWJ1dGlvbi4KLlNIIEZJTEVTCi5uZgovZXRjL3NvY2tk LmNvbmYJXGZCRGFudGVcZlAgc2VydmVyIGNvbmZpZ3VyYXRpb24gZmlsZS4KL2V0 Yy9wYXNzd2QJZmlsZSB1c2VkIHdoZW4gY2hlY2tpbmcgdXNlcm5hbWUvcGFzc3dv cmRzLgouZmkKLlNIIEFVVEhPUlMKRm9yIEluZmVybm8gTmV0dHZlcmsgQS9TLCBO b3J3YXk6CiBNaWNoYWVsIFNodWxkbWFuIDxtaWNoYWVsc0BpbmV0Lm5vPjogRGVz aWduIGFuZCBpbXBsZW1lbnRhdGlvbi4KIEthcmwtQW5kcmUnIFNrZXZpayA8a2Fy bHNAaW5ldC5ubz46IEF1dG9jb25mIGFuZCBwb3J0aW5nLgouU0ggU0VFIEFMU08K c29ja2QoMW0pLCBzb2Nrcy5jb25mKDQpLCBzb2Nrc2lmeSgxKSwgaG9zdHNfYWNj ZXNzKDUpCi5QcApJbmZvcm1hdGlvbiBhYm91dCBuZXcgcmVsZWFzZXMgYW5kIG90 aGVyIHJlbGF0ZWQgaXNzdWVzIGNhbiBiZSBmb3VuZApvbiB0aGUKLk5tIFxmQkRh bnRlXGZQCldXVyBob21lIHBhZ2UgYXQgaHR0cDovL3d3dy5pbmV0Lm5vL2RhbnRl LgphbGlkIHZhbHVlcyBhcmUgXGZCbm9uZVxmUCAodGhlIGRlZmF1bHQpIGFuZApc ZkJyb3V0ZVxmUC4gIFRoZSBsYXR0ZXIgbWlnaHQgcmVxdWlyZSB5b3UgdG8gc2V0 IFxmQnVzZXIucHJpdmlsZWdlZFxmUCB0bwpcZkJyb290XGZQLgoKTm90ZSB0aGF0 IFxmQnJvdXRlXGZQIG1pZ2h0IGNyZWF0ZSBwcm9ibGVtcyBmb3IKZnRwLWNsaWVu dHMgdXNpbmcgYWN0aXZlIGZ0cCBpZiB0aGUgXGZCRGFudGVcZlAgYmluZCBleHRl bnNpb24KaXMgZW5hYmxlZCBmb3IgdGhlIGZ0cC1jbGllbnQuCi5JUCBcZkJpbnRl cm5hbFxmUApUaGUgaW50ZXJuYWwgYWRkcmVzc2VzLiAgQ29ubmVjdGlvbnMgd2ls bCBvbmx5IGJlIGFjY2VwdGVkIG9uIHRoZXNlIGFkZHJlc3Nlcy4KVGhlIGFkZHJl c3MgZ2l2ZW4gbWF5IGJlIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= --Boundary_(ID_neg25AIe/riohtgjnHdu6g) Content-type: application/x-tar; name=psarc-material.tar Content-transfer-encoding: BASE64 Content-disposition: inline; filename=psarc-material.tar bWF0ZXJpYWwvZGFudGUtcHJvcG9zYWxfdjQudHh0AAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAADAwMDA3MTEAMDQwNzE1NgAwMDAwMDEyADAwMDAwMDMwMjY0ADExMTE1NDQ1 MjUzADAwMTcyNjYAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAB1c3RhcgAwMG1uMTMzNzY2AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAc3RhZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwMTQ2 ADAwMDAwMDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxLjAgUHJvamVjdCBJbmZv cm1hdGlvbgoxLjEgTmFtZSBvZiBwcm9qZWN0L2NvbXBvbmVudAoJRGFudGU6IEEg U29ja3Mgc2VydmVyIGFuZCBjbGllbnQgaW1wbGVtZW50YXRpb24KCjEuMiBBdXRo b3Igb2YgZG9jdW1lbnQKCU1heXVyZXNoIE5pcmhhbGkKCjIuMCBQcm9qZWN0IFN1 bW1hcnkKICAyLjEgUHJvamVjdCBEZXNjcmlwdGlvbgoKICAgICAgICBEYW50ZSBp cyBhIGNpcmN1aXQtbGV2ZWwgZmlyZXdhbGwvcHJveHkgdGhhdCBjYW4gYmUgdXNl ZCB0byBwcm92aWRlCiAgICAgICAgY29udmVuaWVudCBhbmQgc2VjdXJlIG5ldHdv cmsgY29ubmVjdGl2aXR5IHRvIGEgd2lkZSByYW5nZSBvZiBob3N0cwogICAgICAg IHdoaWxlIHJlcXVpcmluZyBvbmx5IHRoZSBzZXJ2ZXIgRGFudGUgcnVucyBvbiB0 byBoYXZlIGV4dGVybmFsCiAgICAgICAgbmV0d29yayBjb25uZWN0aXZpdHkuCiAg CiAgMi4yIFJlbGVhc2UgYmluZGluZwogICAgICBXaGF0IGlzIGlzIHRoZSByZWxl YXNlIGJpbmRpbmc/CiAgICAgIChzZWUgaHR0cDovL29wZW5zb2xhcmlzLm9yZy9v cy9jb21tdW5pdHkvYXJjL3BvbGljaWVzL3JlbGVhc2UtdGF4b25vbXkvKQogICAg ICBbIF0gTWFqb3IKICAgICAgW1hdIE1pbm9yCiAgICAgIFsgXSBQYXRjaCBvciBN aWNybwogICAgICBbIF0gVW5rbm93biAtLSBBUkMgcmV2aWV3IHJlcXVpcmVkCgog IDIuMyBUeXBlIG9mIHByb2plY3QKICAgICAgSXMgdGhpcyBjYXNlIGEgTGludXgg RmFtaWxpYXJpdHkgcHJvamVjdD8KICAgICAgW1hdIFllcwogICAgICBbIF0gTm8K CiAgMi40IE9yaWdpbmF0aW5nIENvbW11bml0eQogICAgMi40LjEgQ29tbXVuaXR5 IE5hbWUKCiAgICAgICAgaHR0cDovL3d3dy5pbmV0Lm5vL2RhbnRlLwogICAgCiAg ICAyLjQuMiBDb21tdW5pdHkgSW52b2x2ZW1lbnQKICAgICAgSW5kaWNhdGUgU3Vu J3MgaW52b2x2ZW1lbnQgaW4gdGhlIGNvbW11bml0eQogICAgICBbIF0gTWFpbnRh aW5lcgogICAgICBbIF0gQ29udHJpYnV0b3IKICAgICAgW1hdIE1vbml0b3JpbmcK ICAgICAgCiAgICAgIFdpbGwgdGhlIHByb2plY3QgdGVhbSB3b3JrIHdpdGggdGhl IHVwc3RyZWFtIGNvbW11bml0eSB0byByZXNvbHZlCiAgICAgIGFyY2hpdGVjdHVy YWwgaXNzdWVzIG9mIGludGVyZXN0IHRvIFN1bj8KICAgICAgW1hdIFllcyAKICAg ICAgWyBdIE5vIC0gYnJpZWZseSBleHBsYWluCiAgICAgIAogICAgICBXaWxsIHdl IG9yIGFyZSB3ZSBmb3JraW5nIGZyb20gdGhlIGNvbW11bml0eT8KICAgICAgWyBd IFllcyAtIEFSQyByZXZpZXcgcmVxdWlyZWQgcHJpb3IgdG8gZm9ya2luZwogICAg ICBbWF0gTm8KICAgICAgCjMuMCBUZWNobmljYWwgRGVzY3JpcHRpb24KICAzLjEg SW5zdGFsbGF0aW9uICYgU2hhcmFibGUKICAgIDMuMS4xUyBTb2xhcmlzIEluc3Rh bGxhdGlvbiAtIHNlY3Rpb24gb25seSByZXF1aXJlZCBmb3IgU29sYXJpcyBTb2Z0 d2FyZQogICAgICAoc2VlIGh0dHA6Ly9vcGVuc29sYXJpcy5vcmcvb3MvY29tbXVu aXR5L2FyYy9wb2xpY2llcy9pbnN0YWxsLWxvY2F0aW9ucy8gZm9yIGRldGFpbHMp CiAgICAgIERvZXMgdGhpcyBwcm9qZWN0IGZvbGxvdyB0aGUgSW5zdGFsbCBMb2Nh dGlvbnMgYmVzdCBwcmFjdGljZT8KICAgICAgW1hdIFllcyAKICAgICAgWyBdIE5v IC0gQVJDIHJldmlldyByZXF1aXJlZAogICAgICAKICAgICAgRG9lcyB0aGlzIHBy b2plY3QgaW5zdGFsbCBpbnRvIC91c3IgdW5kZXIgW3NiaW58YmlufGxpYnxpbmNs dWRlfG1hbnxzaGFyZV0/CiAgICAgIFtYXSBZZXMKICAgICAgWyBdIE5vIG9yIE4v QQogICAgICAKICAgICAgRG9lcyB0aGlzIHByb2plY3QgaW5zdGFsbCBpbnRvIC9v cHQ/CiAgICAgIFsgXSBZZXMgLSBleHBsYWluIGJlbG93CiAgICAgIFtYXSBObyBv ciBOL0EKICAgICAgCiAgICAgIERvZXMgdGhpcyBwcm9qZWN0IGluc3RhbGwgaW50 byBhIGRpZmZlcmVudCBkaXJlY3Rvcnkgc3RydWN0dXJlPwogICAgICBbIF0gWWVz IC0gQVJDIHJldmlldyByZXF1aXJlZAogICAgICBbWF0gTm8gb3IgTi9BCiAgICAg IAogICAgICBEbyBhbnkgb2YgdGhlIGNvbXBvbmVudHMgb2YgdGhpcyBwcm9qZWN0 IGNvbmZsaWN0IHdpdGggYW55dGhpbmcgdW5kZXIgL3Vzcj8KICAgICAgKHNlZSBo dHRwOi8vb3BlbnNvbGFyaXMub3JnL29zL2NvbW11bml0eS9hcmMvY2FzZWxvZy8y MDA3LzA0Ny8gZm9yIGRldGFpbHMpCiAgICAgIFsgXSBZZXMgLSBleHBsYWluIGJl bG93CiAgICAgIFtYXSBObwogICAgICAKICAgICAgSWYgY29uZmxpY3RzIGV4aXN0 IHRoZW4gd2lsbCB0aGlzIHByb2plY3QgaW5zdGFsbCB1bmRlciAvdXNyL2dudT8K ICAgICAgWyBdIFllcwogICAgICBbIF0gTm8gLSBBUkMgcmV2aWV3IHJlcXVpcmVk CiAgICAgIFtYXSBOL0EKICAgICAgCiAgICAgIElzIHRoaXMgcHJvamVjdCBpbnN0 YWxsaW5nIGludG8gL3Vzci9zZnc/CiAgICAgIFsgXSBZZXMgLSBBUkMgcmV2aWV3 IHJlcXVpcmVkCiAgICAgIFtYXSBObwogICAgICAKCiAgMy4yIEV4cG9ydGVkIExp YnJhcmllcwogICAgICBBcmUgbGlicmFyaWVzIGJlaW5nIGRlbGl2ZXJlZCBieSB0 aGlzIHByb2plY3Q/CiAgICAgIFtYXSBZZXMKICAgICAgWyBdIE5vIC0gY29udGlu dWUgd2l0aCBuZXh0IHNlY3Rpb24gKHNlY3Rpb24gMy4zKQogICAgICAKICAgICAg QXJlIDY0LWJpdCB2ZXJzaW9ucyBvZiB0aGUgbGlicmFyaWVzIGJlaW5nIGRlbGl2 ZXJlZD8KICAgICAgW1hdIFllcwogICAgICBbIF0gTm8gLSBBUkMgcmV2aWV3IHJl cXVpcmVkCiAgICAKICAgICAgQXJlIHN0YXRpYyB2ZXJzaW9ucyBvZiB0aGUgbGli cmFyaWVzIGJlaW5nIGRlbGl2ZXJlZD8KICAgICAgWyBdIFllcyAtIEFSQyByZXZp ZXcgcmVxdWlyZWQKICAgICAgW1hdIE5vIAogICAgICAKICAzLjMgU2VydmljZXMg YW5kIHRoZSAvZXRjIERpcmVjdG9yeQogICAgICAoc2VlIGh0dHA6Ly9vcGVuc29s YXJpcy5vcmcvb3MvY29tbXVuaXR5L2FyYy9wb2xpY2llcy9TTUYtcG9saWN5LykK ICAgICAgRG9lcyB0aGUgcHJvamVjdCBpbnRlZ3JhdGUgYW55dGhpbmcgaW50byAv ZXRjL2luaXQuZCBvciAvZXRjL3JjPy5kPwogICAgICBbIF0gWWVzIC0gQVJDIHJl dmlldyByZXF1aXJlZAogICAgICBbWF0gTm8KICAgICAgCiAgICAgIERvZXMgdGhl IHByb2plY3QgaW50ZWdyYXRlIGFueSBuZXcgZW50cmllcyBpbnRvIC9ldGMvaW5p dHRhYiBvcgogICAgICAvZXRjL2luZXRkLmNvbmY/CiAgICAgIFsgXSBZZXMgLSBB UkMgcmV2aWV3IHJlcXVpcmVkCiAgICAgIFtYXSBObwogICAgICAKICAgICAgRG9l cyB0aGUgcHJvamVjdCBpbnRlZ3JhdGUgYW55IHByaXZhdGUgbm9uLXB1YmxpYyBm aWxlcyBpbnRvIC9ldGMvZGVmYXVsdAogICAgICBvciAvZXRjLyBjb25maWd1cmF0 aW9uIGZpbGVzPwogICAgICBbIF0gWWVzIC0gQVJDIHJldmlldyByZXF1aXJlZAog ICAgICBbWF0gTm8KICAgICAgCiAgICAgIERvZXMgdGhlIHNlcnZpY2UgbWFuaWZl c3RzIG1ldGhvZCBjb250ZXh0IGdyYW50IHJpZ2h0cyBhYm92ZSB0aGF0CiAgICAg IG9mIHRoZSBub2FjY2VzcyB1c2VyIGFuZCBiYXNpYyBwcml2aWxlZ2Ugc2V0Pwog ICAgICBbIF0gWWVzIC0gQVJDIHJldmlldyByZXF1aXJlZAogICAgICBbWF0gTm8K ICAgICAgICAKICAzLjQgU2VjdXJpdHkKICAgIDMuNC4xIFNlY3VyZSBCeSBEZWZh dWx0IAogICAgICAoc2VlIGh0dHA6Ly9vcGVuc29sYXJpcy5vcmcvb3MvY29tbXVu aXR5L2FyYy9wb2xpY2llcy9zZWN1cmUtYnktZGVmYXVsdC8gZm9yIGRldGFpbHMp CiAgICAgIChzZWUgaHR0cDovL3d3dy5vcGVuc29sYXJpcy5vcmcvb3MvY29tbXVu aXR5L2FyYy9wb2xpY2llcy9OSVRTLXBvbGljeS8gZm9yIGRldGFpbHMpCiAgICAg IChzZWUgcGFydHMgb2YgaHR0cDovL29wZW5zb2xhcmlzLm9yZy9vcy9jb21tdW5p dHkvYXJjL3BvbGljaWVzL1NNRi1wb2xpY3kvIGZvcgogICAgICAgYWRkdGlvbmFs IGRldGFpbHMpCiAgICAgIEFyZSB0aGVyZSBhbnkgbmV0d29yayBzZXJ2aWNlcyBw cm92aWRlZCBieSB0aGlzIHByb2plY3Q/CiAgICAgIFtYXSBZZXMKICAgICAgWyBd IE5vIC0gY29udGludWUgd2l0aCB0aGUgbmV4dCBzZWN0aW9uIChzZWN0aW9uIDMu NC4yKQogICAgICAKICAgICAgQXJlIG5ldHdvcmsgc2VydmljZXMgZW5hYmxlZCBi eSBkZWZhdWx0PwogICAgICBbIF0gWWVzIC0gQVJDIHJldmlldyByZXF1aXJlZAog ICAgICBbWF0gTm8KICAgICAgWyBdIE4vQQogICAgICAKICAgICAgQXJlIG5ldHdv cmsgc2VydmljZXMgYXV0b21hdGljYWxseSBlbmFibGVkIGJ5IHRoZSBwcm9qZWN0 IGR1cmluZyBpbnN0YWxsYXRpb24/CiAgICAgIFsgXSBZZXMgLSBBUkMgcmV2aWV3 IHJlcXVpcmVkCiAgICAgIFtYXSBObwogICAgICBbIF0gTi9BCiAgICAgIAogICAg ICBBcmUgaW5ib3VuZCBuZXR3b3JrIGNvbW11bmljYXRpb25zIGRlbmllZCBieSBk ZWZhdWx0PwogICAgICBbIF0gWWVzCiAgICAgIFsgXSBObyAtIEFSQyByZXZpZXcg cmVxdWlyZWQKICAgICAgW1hdIE4vQQogICAgICAKICAgICAgSXMgaW5ib3VuZCBk YXRhIGNoZWNrZWQgdG8gcHJldmVudCBjb250ZW50LWJhc2VkIGF0dGFja3M/CiAg ICAgIFsgXSBZZXMKICAgICAgWyBdIE5vIC0gQVJDIHJldmlldyByZXF1aXJlZAog ICAgICBbWF0gTi9BCiAgICAgIAogICAgICBJcyB0aGUgb3V0Ym91bmQgcmVjZWl2 ZXIgYXV0aGVudGljYXRlZD8KICAgICAgWyBdIFllcwogICAgICBbIF0gTm8gLSBB UkMgcmV2aWV3IHJlcXVpcmVkCiAgICAgIFtYXSBOL0EKICAgICAgCiAgICAgIElz IHRoZSByZWNlaXZlciBhdXRoZW50aWNhdGVkIHByaW9yIHRvIHJlY2VpdmluZyBh bnkgc2Vuc2l0aXZlIG91dGJvdW5kIGNvbW11bmljYXRpb24/CiAgICAgIFsgXSBZ ZXMKICAgICAgWyBdIE5vIC0gQVJDIHJldmlldyByZXF1aXJlZAogICAgICBbWF0g Ti9BCiAgICAgIAogICAgMy40LjIgQXV0aG9yaXphdGlvbgogICAgICAoc2VlIGh0 dHA6Ly9vcGVuc29sYXJpcy5vcmcvb3MvY29tbXVuaXR5L2FyYy9iZXN0cHJhY3Rp Y2VzL3JiYWMtaW50cm8vIGFuZAoJICAgaHR0cDovL29wZW5zb2xhcmlzLm9yZy9v cy9jb21tdW5pdHkvYXJjL2Jlc3RwcmFjdGljZXMvcmJhYy1wcm9maWxlcy8gYW5k CgkgICBodHRwOi8vb3BlbnNvbGFyaXMub3JnL29zL2NvbW11bml0eS9hcmMvYmVz dHByYWN0aWNlcy9yYmFjLXByb2ZpbGVzLwogICAgICAgICAgIGZvciBkZXRhaWxz KQogICAgICBBcmUgdGhlcmUgYW55IHNldHVpZC9zZXRnaWQgcHJpdmlsZWdlZCBi aW5hcmllcyBpbiB0aGUgcHJvamVjdD8KICAgICAgWyBdIFllcyAtIEFSQyByZXZp ZXcgcmVxdWlyZWQKICAgICAgW1hdIE5vIC0gY29udGludWUgd2l0aCBuZXh0IHNl Y3Rpb24gKHNlY3Rpb24gMy40LjMpCiAgICAgIAogICAgICBJZiB5ZXMgdGhlbiBh cmUgdGhlIHNldHVpZC9zZXRnaWQgcHJpdmlsZWdlcyBoYW5kbGVkIGJ5IHRoZSB1 c2Ugb2Ygcm9sZXM/CiAgICAgIFsgXSBZZXMKICAgICAgWyBdIE5vIC0gQVJDIHJl dmlldyByZXF1aXJlZAoKICAgIDMuNC4zIEF1ZGl0aW5nCiAgICAgIChzZWUgaHR0 cDovL29wZW5zb2xhcmlzLm9yZy9vcy9jb21tdW5pdHkvYXJjL3BvbGljaWVzL2F1 ZGl0LXBvbGljeS8gZm9yIGRldGFpbHMpCiAgICAgIChzZWUgaHR0cDovL29wZW5z b2xhcmlzLm9yZy9vcy9jb21tdW5pdHkvYXJjL2Nhc2Vsb2cvMjAwMy8zOTcgZm9y IGRldGFpbHMpCiAgICAgIERvZXMgdGhpcyBjb21wb25lbnQgY29udGFpbiBhZG1p bmlzdHJhdGl2ZSBvciBzZWN1cml0eSBlbmZvcmNpbmcgc29mdHdhcmU/CiAgICAg IFtYXSBZZXMgLSBBUkMgcmV2aWV3IHJlcXVpcmVkCiAgICAgIFsgXSBObyAtIGNv bnRpbnVlIHRvIG5leHQgc2VjdGlvbiAoc2VjdGlvbiAzLjQuNCkKICAgICAgCiAg ICAgIChzZWUgaHR0cDovL29wZW5zb2xhcmlzLm9yZy9vcy9jb21tdW5pdHkvYXJj L2Nhc2Vsb2cvMjAwMy8zOTcgZm9yIGRldGFpbHMpCiAgICAgIERvIHRoZSBjb21w b25lbnRzIGNyZWF0ZSBhdWRpdCBsb2dzIGRldGFpbGluZyB3aGF0IHRvb2sgcGxh Y2UgaW5jbHVkaW5nIHdoYXQgZXZlbnQKICAgICAgdG9vayBwbGFjZSwgd2hvIHdh cyBpbnZvbHZlZCwgd2hlbiB0aGUgZXZlbnQgdG9vayBwbGFjZT8KICAgICAgWyBd IFllcyAtIEFSQyBjb250cmFjdCBhbmQgQXVkaXQgcHJvamVjdCB0ZWFtIHJldmll dyByZXF1aXJlZAogICAgICBbWF0gTm8gLSBBUkMgcmV2aWV3IHJlcXVpcmVkCiAg ICAgICAgCiAgICAgICAgCiAgICAzLjQuNCBBdXRoZW50aWNhdGlvbgogICAgICAo c2VlIGh0dHA6Ly9vcGVuc29sYXJpcy5vcmcvb3MvY29tbXVuaXR5L2FyYy9wb2xp Y2llcy9QQU0vKQogICAgICBEbyB0aGUgY29tcG9uZW50cyBjb250YWluIGFueSBh dXRoZW50aWNhdGlvbiBjb2RlPwogICAgICBbWF0gWWVzCiAgICAgIFsgXSBObyAt IGNvbnRpbnVlIHRvIG5leHQgc2VjdGlvbiAoc2VjdGlvbiAzLjQuNSkKICAgICAg CiAgICAgIElmIHllcyBkbyB0aGUgY29tcG9uZW50cyB1c2UgUEFNIChwbHVnYWJs ZSBhdXRoZW50aWNhdGlvbiBtb2R1bGVzKSBmb3IgYXV0aGVudGljYXRpb24/CiAg ICAgIFtYXSBZZXMKICAgICAgWyBdIE5vIC0gQVJDIHJldmlldyByZXF1aXJlZAog ICAgICAKICAgICAgSWYgeWVzIGlzIGEgc2luZ2xlIFBBTSBzZXNzaW9uIG1haW50 YWluZWQgZHVyaW5nIGF1dGhlbnRpY2F0aW9uPwogICAgICBbWF0gWWVzCiAgICAg IFsgXSBObyAtIEFSQyByZXZpZXcgcmVxdWlyZWQKICAgICAgCiAgICAgIElmIHll cyBhcmUgdGhlIGNvbXBvbmVudHMgc3VmZmljaWVudGx5IHByaXZpbGVnZWQgdG8g YWxsb3cgdGhlIHJlcXVlc3RlZCAKICAgICAgb3BlcmF0aW9ucyAoYXV0aGVudGlj YXRpb24sIHBhc3N3b3JkIGNoYW5nZSwgcHJvY2VzcyBjcmVkZW50aWFsIG1hbmlw dWxhdGlvbiwgCiAgICAgIGF1ZGl0IHN0YXRlIGluaXRpYWxpemF0aW9uKT8KICAg ICAgW1hdIFllcyAtIGJyaWVmbHkgZGVzY3JpYmUgYmVsb3cKICAgICAgWyBdIE5v IC0gQVJDIHJldmlldyByZXF1aXJlZAoKCURhbnRlIHVzZXMgUEFNIG9ubHkgZm9y IGF1dGhlbnRpY2F0aW9uIGFuZCBhY3F1aXJlcyBzdWZmaWNpZW50IHByaXZpbGVn ZXMgYmVmb3JlCgljYWxsaW5nIHBhbSBvcGVyYXRpb25zLgogICAgICAKICAgIDMu NC41IFBhc3N3b3JkcwogICAgICAoc2VlIGh0dHA6Ly9vcGVuc29sYXJpcy5vcmcv b3MvY29tbXVuaXR5L2FyYy9iZXN0cHJhY3RpY2VzL3Bhc3N3b3Jkcy1jbGkvIGFu ZAogICAgICAgICAgIGh0dHA6Ly9vcGVuc29sYXJpcy5vcmcvb3MvY29tbXVuaXR5 L2FyYy9iZXN0cHJhY3RpY2VzL3Bhc3N3b3Jkcy1maWxlcy8gZm9yIGRldGFpbHMp CiAgICAgIERvIGFueSBvZiB0aGUgY29tcG9uZW50cyBmb3IgdGhlIHByb2plY3Qg ZGVhbCB3aXRoIHBhc3N3b3Jkcz8KICAgICAgW1hdIFllcwogICAgICBbIF0gTm8g LSBjb250aW51ZSB0byBuZXh0IHNlY3Rpb24gKHNlY3Rpb24gMy40LjYpCiAgICAg IAogICAgICBJZiB5ZXMgYXJlIHRoZXNlIHBhc3N3b3JkcyBlbnRlcmVkIHZpYSB0 aGUgQ0xJIG9yIGVudmlyb25tZW50PwogICAgICBbWF0gWWVzIC0gQVJDIHJldmll dyByZXF1aXJlZAogICAgICBbIF0gTm8KCglwYXNzd29yZHMgYXJlIGVudGVyZWQg dmlhIENMSS4gCiAgICAgIAogICAgICBBcmUgcGFzc3dvcmRzIHN0b3JlZCB3aXRo aW4gdGhlIGZpbGUgc3lzdGVtIGZvciB0aGUgY29tcG9uZW50PwogICAgICBbIF0g WWVzCiAgICAgIFtYXSBObyAtIGNvbnRpbnVlIHRvIG5leHQgc2VjdGlvbiAoc2Vj dGlvbiAzLjQuNikKCiAgICAgCWRhbnRlIGNhbiB3b3JrIHdpdGggU09DS1NfVVNF Uk5BTUUgJiBTT0NLU19QQVNTV09SRCB2YXJpYWJsZXMgaWYgc2V0IGluIHRoZSBl bnZpcm9ubWVudC4KIAogICAgICBJZiB5ZXMgYXJlIHRoZSBwZXJtaXNzaW9ucyBv biB0aGUgZmlsZSBzdWNoIHRvIHByb3RlY3QgZXhwb3NpbmcgdGhlIHBhc3N3b3Jk KHMpPwogICAgICBbIF0gWWVzCiAgICAgIFsgXSBObyAtIEFSQyByZXZpZXcgcmVx dWlyZWQKICAgICAgCiAgICAzLjQuNiBHZW5lcmFsIFNlY3VyaXR5IFF1ZXN0aW9u cwogICAgICAoc2VlIGh0dHA6Ly9vcGVuc29sYXJpcy5vcmcvb3MvY29tbXVuaXR5 L2FyYy9iZXN0cHJhY3RpY2VzL3NlY3VyaXR5LXF1ZXN0aW9ucy8gZm9yIGRldGFp bHMpCiAgICAgIEFyZSB0aGVyZSBhbnkgbmV0d29yayBwcm90b2NvbHMgdXNlZCBi eSB0aGlzIHByb2plY3Q/CiAgICAgIFtYXSBZZXMKICAgICAgWyBdIE5vIC0gY29u dGludWUgd2l0aCB0aGUgbmV4dCBzZWN0aW9uIChzZWN0aW9uIDMuNSkKICAgICAg CiAgICAgIERvIHRoZSBjb21wb25lbnRzIHVzZSBzdGFuZGFyZCBuZXR3b3JrIHBy b3RvY29scz8KICAgICAgW1hdIFllcwogICAgICBbIF0gTm8gLSBBUkMgcmV2aWV3 IHJlcXVpcmVkCiAgICAgIAogICAgICBEbyBuZXR3b3JrIHNlcnZpY2VzIGZvciB0 aGUgcHJvamVjdCBtYWtlIGRlY2lzaW9ucyBiYXNlZCB1cG9uIHVzZXIsIGhvc3Qg b3IgCiAgICAgIHNlcnZpY2UgaWRlbnRpdGllcz8KICAgICAgW1hdIFllcyAtIGV4 cGxhaW4gYmVsb3cKICAgICAgWyBdIE5vCiAgICAgIFsgXSBOL0EKCglEYW50ZSwg bGlrZSBhIHR5cGljYWwgU29ja3Mgc2VydmVyLCBhdXRoZW50aWNhdGVzIHVzZXJz IGJhc2VkIG9uIHZhcmlvdXMgbWV0aG9kcyAKCWxpa2UsIFBBTSwgdXNlcm5hbWUg ZXRjLgoJZGFudGUgYWxzbyBtYWtlcyByb3V0aW5nIGRlY2lzaW9ucyBiYXNlZCBv biB0aGUgaG9zdHMgY29uZmlndXJlZCBpbiB0aGUgc29ja3MuY29uZiBzYW1wbGUg ZmlsZS4gCiAgICAgIAogICAgICBEbyB0aGUgY29tcG9uZW50cyBtYWtlIHVzZSBv ZiBzZWNyZXQgaW5mb3JtYXRpb24gZHVyaW5nIGF1dGhlbnRpY2F0aW9uIGFuZC9v cgogICAgICBhdXRob3JpemF0aW9uPwogICAgICBbWF0gWWVzIC0gZXhwbGFpbiBi ZWxvdwogICAgICBbIF0gTm8KICAgICAgWyBdIE4vQQoKCURhbnRlIHVzZXMgcGFz c3dvcmRzIGZvciBhdXRoZW50aWNhdGlvbi4KICAKICAzLjUgTmV0d29ya2luZwog ICAgICBEbyB0aGUgY29tcG9uZW50cyBhY2Nlc3MgdGhlIG5ldHdvcms/CiAgICAg IFtYXSBZZXMKICAgICAgWyBdIE5vIC0gY29udGludWUgd2l0aCB0aGUgbmV4dCBz ZWN0aW9uIChzZWN0aW9uIDMuNikKICAgICAgCiAgICAgIElmIHllcyBkbyB0aGUg Y29tcG9uZW50cyBzdXBwb3J0IElQdjY/CiAgICAgIFtYXSBZZXMgCiAgICAgIFsg XSBObyAtIEFSQyByZXZpZXcgcmVxdWlyZWQKICAgICAgICAgIAogIDMuNiBDb3Jl IFNvbGFyaXMgQ29tcG9uZW50cwogICAgICBEbyB0aGUgY29tcG9uZW50cyBvZiB0 aGlzIHByb2plY3QgY29tcGV0ZSB3aXRoIG9yIGR1cGxpY2F0ZSBjb3JlIAogICAg ICBTb2xhcmlzIGNvbXBvbmVudHM/CiAgICAgIFsgXSBZZXMgLSBBUkMgcmV2aWV3 IHJlcXVpcmVkCiAgICAgIFtYXSBObyAKICAgICAgCiAgICAgIEV4YW1wbGVzIG9m IENvcmUgU29sYXJpcyBDb21wb25lbnRzIGluY2x1ZGUgYnV0IGFyZSBub3QgbGlt aXRlZCB0bzoKICAgICAgCiAgICAgICAgU2VjdXJlIEJ5IERlZmF1bHQKICAgICAg ICBBdXRob3JpemF0aW9ucwogICAgICAgIFBBTSAtLSBQbHVnYWJsZSBBdXRoZW50 aWNhdGlvbiBNb2R1bGUKICAgICAgICBQcml2aWxlZ2UKICAgICAgICBQUk0gLS0g UHJvY2VzcyBSaWdodHMgTWFuYWdlbWVudCAtLSBQcml2aWxlZ2UKICAgICAgICBB dWRpdAogICAgICAgIHhWbSAtLSBWaXJ0dWFsaXphdGlvbgogICAgICAgIHpvbmVz IC8gU29sYXJpcyBDb250YWluZXJzCiAgICAgICAgUFJNIC0tIFByb2Nlc3MgUmln aHRzIE1hbmFnZW1lbnQKICAgICAgICBSQkFDIC0tIFJvbGUgQmFzZWQgQWNjZXNz IENvbnRyb2wKICAgICAgICBUWCAvIFRydXN0ZWQgRXh0ZW5zaW9ucwogICAgICAg IFpGUwogICAgICAgIFNNRiAtLSBTZXJ2aWNlIE1hbmFnZW1lbnQgRmFjaWxpdHkK ICAgICAgICBGTUEgLS0gRmF1bHQgTWFuYWdlbWVudCBBcmNoaXRlY3R1cmUKICAg ICAgICBTQ0YgLS0gU21hcnQgQ2FyZCBGYWNpbGl0eQogICAgICAgIElQc2VjCiAg ICAgICAgCjQuMCBJbnRlcmZhY2VzCiAgKHNlZSBodHRwOi8vd3d3Lm9wZW5zb2xh cmlzLm9yZy9vcy9jb21tdW5pdHkvYXJjL3BvbGljaWVzL2ludGVyZmFjZS10YXhv bm9teS8gZm9yIGRldGFpbHMpCiAgNC4xIEV4cG9ydGVkIEludGVyZmFjZXMKIAog ICAgICAgICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsKICAgICAgICAg fCAgIHwgSW50ZXJmYWNlIE5hbWUgICAgICB8IENsYXNzaWZpY2F0aW9uICAgICAg IHwgQ29tbWVudHMgICAgICAgICAgICAgICAgICB8CiAgICAgICAgIHwtLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tfAogICAgICAgICB8IDEgfCBsaWJkc29ja3Mu c28gICAgICAgIHwgUHJvamVjdCBQcml2YXRlICAgICAgfCBTT0NLUyBkYWVtb24g bGlicmFyeSAgICAgIHwKICAgICAgICAgfCAgIHwtLS0tLS0tLS0tLS0tLS0tLS0t LS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS18CiAgICAgICAgIHwgMiB8IGxpYnNvY2tzLnNvICAgICAgICAgfCBDb21t aXR0ZWQgICAgICAgICAgICB8IFNPQ0tTIGxpYnJhcnkgICAgICAgICAgICAgfAog ICAgICAgICB8ICAgfC0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLXwKICAgICAgICAg fCAzIHwgc29ja3NpZnkgICAgICAgICAgICB8IFVuY29tbWl0dGVkICAgICAgICAg IHwgU09DS1MgY2xpZW50IHNjcmlwdCAgICAgICB8CiAgICAgICAgIHwgICB8LS0t LS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tfAogICAgICAgICB8IDQgfCBzb2NrZCAgICAg ICAgICAgICAgIHwgVW5jb21taXR0ZWQgICAgICAgICAgfCBTT0NLUyBzZXJ2ZXIg ZGFlbW9uICAgICAgIHwKICAgICAgICAgfCAgIHwtLS0tLS0tLS0tLS0tLS0tLS0t LS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS18CiAgICAgICAgIHwgNSB8IHNvY2tzLmNvbmYgICAgICAgICAgfCBVbmNv bW1pdHRlZCAgICAgICAgICB8IENsaWVudCBjb25maWd1cmF0aW9uIGZpbGUgfAog ICAgICAgICB8ICAgfC0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLXwKICAgICAgICAg fCA2IHwgc29ja2QuY29uZiAgICAgICAgICB8IFVuY29tbWl0dGVkICAgICAgICAg IHwgU2VydmVyIGNvbmZpZ3VyYXRpb24gZmlsZSB8CiAgICAgICAgIHwgICB8LS0t LS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tfAogICAgICAgICB8IDcgfCBTVU5XbGlic29j a3MgICAgICAgIHwgUHVibGljL0NvbW1pdHRlZCAgICAgfCBDbGllbnQgcGFja2Fn ZSAgICAgICAgICAgIHwKICAgICAgICAgfCAgIHwtLS0tLS0tLS0tLS0tLS0tLS0t LS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS18CiAgICAgICAgIHwgOCB8IFNVTldkYW50ZXUgICAgICAgICAgfCBQdWJs aWMvQ29tbWl0dGVkICAgICB8IFNlcnZlciBwYWNrYWdlIChVc2VyKSAgICAgfAog ICAgICAgICB8ICAgfC0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLXwKICAgICAgICAg fCA5IHwgU1VOV2RhbnRlciAgICAgICAgICB8IFB1YmxpYy9Db21taXR0ZWQgICAg IHwgU2VydmVyIHBhY2thZ2UgKFJvb3QpICAgICB8CgkgfCAgIHwtLS0tLS0tLS0t LS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS18CgkgfDEwIHwgbmV0d29yay9zb2NrcwkgICB8IFB1Ymxp Yy9Db21taXR0ZWQJICB8IFNNRiBTZXJ2aWNlIG5hbWUgICAJICAgICAgfAoJIHwg ICB8LS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tfAoJIHwxMSB8IHNvY2tkCQkgICB8 IFVuY29tbWl0dGVkCSAgfCBQQU0gU2VydmljZW5hbWUJICAgICAgfAogICAgICAg ICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsKIAogICAgCiAgNC4yIElt cG9ydGVkIEludGVyZmFjZXMKICAgIEludGVyZmFjZSBOYW1lCQlDbGFzc2lmaWNh dGlvbiAgICAgICBDb21tZW50cwogICAgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tIC0tLS0tLS0tLS0tLS0tLS0tLS0tIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tCiAgIAoJTk9ORSAKICAgIApSQyByZXZpZXcgcmVxdWlyZWQKICAgIAogICAg ICBBcmUgc3RhdGljIHZlcnNpb25zIG9mIHRoZSBsaWJyYXJpZXMgYmVpbmcgZGVs aXZlcmVkPwogICAgICBbIF0gWWVzIC0gQVJDIHJldmlldyByZXF1aXJlZAogICAg ICBbWF0gTm8gCiAgICAgIAogIDMuMyBTZXJ2aWNlcyBhbmQgdGhlIC9ldGMgRGly ZWN0b3J5CiAgICAgIChzZWUgaHR0cDovL29wZW5zb2xhcmlzLm9yZy9vcy9jb21t dW5pdHkvYXJjL3BvbGljaWVzL1NNRi1wb2xpY3kvKQogICAgICBEb2VzIHRoZSBw cm9qZWN0IGludGVncmF0ZSBhbnl0aGluZyBpbnRvIC9ldGMvaW5pdC5kIG9yIC9l dGMvcmM/LmQ/CiAgICAgIG1hdGVyaWFsL2RhbnRlX29uZXBhZ2VyX3YyLnR4dAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwNjAwADA0MDcxNTYAMDAwMDAxMgAwMDAw MDAzMTU1MgAxMTExNTQ0NTI1MwAwMDE3MzA1ADAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdXN0YXIAMDBtbjEzMzc2 NgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHN0YWZmAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAMDAwMDE0NgAwMDAwMDAzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA VGVtcGxhdGUgVmVyc2lvbjogQCgjKW9uZXBhZ2VyLnR4dCAxLjM1IDA3LzExLzA3 IFNNSQpDb3B5cmlnaHQgMjAwNyBTdW4gTWljcm9zeXN0ZW1zCgoxLiBJbnRyb2R1 Y3Rpb24KICAgMS4xLiBQcm9qZWN0L0NvbXBvbmVudCBXb3JraW5nIE5hbWU6CglE YW50ZTogQSBTb2NrcyBzZXJ2ZXIgYW5kIGNsaWVudCBpbXBsZW1lbnRhdGlvbgoK ICAgMS4yLiBOYW1lIG9mIERvY3VtZW50IEF1dGhvci9TdXBwbGllcjoKCU1heXVy ZXNoIE5pcmhhbGkKCiAgIDEuMy4gRGF0ZSBvZiBUaGlzIERvY3VtZW50OgoJMDgv MjYvMjAwOAoJCgkxLjMuMS4gRGF0ZSB0aGlzIHByb2plY3Qgd2FzIGNvbmNlaXZl ZDoKCQlOL0EKCiAgIDEuNC4gTmFtZSBvZiBNYWpvciBEb2N1bWVudCBDdXN0b21l cihzKS9Db25zdW1lcihzKToKCTEuNC4xLiBUaGUgUEFDIG9yIENQVCB5b3UgZXhw ZWN0IHRvIHJldmlldyB5b3VyIHByb2plY3Q6CgkJU29sYXJpcwoKCTEuNC4yLiBU aGUgQVJDKHMpIHlvdSBleHBlY3QgdG8gcmV2aWV3IHlvdXIgcHJvamVjdDoKCQlQ U0FSQwoKCTEuNC4zLiBUaGUgRGlyZWN0b3IvVlAgd2hvIGlzICJTcG9uc29yaW5n IiB0aGlzIHByb2plY3Q6CgkJQ2hyaXMuQXJtZXNAU3VuLkNPTQoKCTEuNC40LiBU aGUgbmFtZSBvZiB5b3VyIGJ1c2luZXNzIHVuaXQ6CgkJU29sYXJpcyAtIFJQRQoK ICAgMS41LiBFbWFpbCBBbGlhc2VzOgogICAgCTEuNS4xLiBSZXNwb25zaWJsZSBN YW5hZ2VyOiBMdWthcy5Sb3ZlbnNreUBTdW4uQ09NCiAgICAJMS41LjIuIFJlc3Bv bnNpYmxlIEVuZ2luZWVyOiBNYXl1cmVzaC5OaXJoYWxpQFN1bi5DT00KICAgIAkx LjUuMy4gTWFya2V0aW5nIE1hbmFnZXI6IAoJMS41LjQuIEludGVyZXN0IExpc3Q6 ICBzZndudi1kaXNjdXNzQG9wZW5zb2xhcmlzLm9yZwoKMi4gUHJvamVjdCBTdW1t YXJ5CiAgIDIuMS4gUHJvamVjdCBEZXNjcmlwdGlvbjoKCglEYW50ZSBpcyBhIGNp cmN1aXQtbGV2ZWwgZmlyZXdhbGwvcHJveHkgdGhhdCBjYW4gYmUgdXNlZCB0byBw cm92aWRlIAoJY29udmVuaWVudCBhbmQgc2VjdXJlIG5ldHdvcmsgY29ubmVjdGl2 aXR5IHRvIGEgd2lkZSByYW5nZSBvZiBob3N0cyAKCXdoaWxlIHJlcXVpcmluZyBv bmx5IHRoZSBzZXJ2ZXIuIERhbnRlIHJ1bnMgb24gdG8gaGF2ZSBleHRlcm5hbCAK CW5ldHdvcmsgY29ubmVjdGl2aXR5LgoKICAgMi4yLiBSaXNrcyBhbmQgQXNzdW1w dGlvbnM6CgoJRGFudGUgaXMgYSB0aGlyZCBwYXJ0eSBTb2NrcyBzZXJ2ZXIgYW5k IGNsaWVudCBpbXBsZW1lbnRhdGlvbi4gVGhlIAoJY3VycmVudCB2ZXJzaW9uICgx LjEuMTkpIGlzIHN0YWJsZSBhbmQgaXQgd2FzIHJlbGVhc2VkIGluCglKYW51YXJ5 IDIwMDYuIFNpbmNlIHRoZW4sIHRoZXJlIGhhcyBiZWVuIG5vIHJlbGVhc2VzIG9m IHRoaXMgcHJvZHVjdC4KCglBbnkgYnVncyBmb3VuZCBmb3IgdGhpcyBwcm9kdWN0 IHdpbGwgYmUgcmVkaXJlY3RlZCB0byB0aGUgb3duZXJzLiBDb25zaWRlcmluZwoJ dGhhdCB0aGVyZSBzZWVtcyB0byBiZSBubyBhY3RpdmUgZGV2ZWxvcG1lbnQgb24g dGhpcyBwcm9kdWN0IHNpbmNlIDIwMDYsCgl0aGUgYnVncy9pc3N1ZXMgbWF5IHRh a2UgbG9uZ2VyIHRvIHJlc29sdmUuCgogICAyLjMuIFNNRgoKICAgICAgICBEYW50 ZSBTT0NLUyBzZXJ2ZXIgd2lsbCBiZSBtYW5hZ2VkIGFzIGEgU01GIHNlcnZpY2Uu IFRoZSBEYW50ZSBzZXJ2ZXIgCgl3b3VsZCBydW4gd2l0aCBMZWFzdCBQcml2aWxl Z2Ugc3BlY2lmaWVkIHRocm91Z2ggdGhlIFNNRiBtYW5pZmVzdC4gIAoJSXQgd291 bGQgbm90IG5lZWQgdG8gaGF2ZSBhbnkgb2YgdGhlIFNVSUQvU0dJRCBiaXRzIGlu IHRoZSBmaWxlIHN5c3RlbSAKCXRvIGJlIHNldCBub3Igd291bGQgdGhlIGRhZW1v biBpdHNlbGYgbmVlZCBhbiBSQkFDIGVudHJ5LCBiZWNhdXNlIFNNRiAKCSdzdGFy dCcgbWV0aG9kIHdvdWxkIHNldCB0aGUgcHJpdmlsZWdlcyBhbmQgVUlEL0dJRCBh cyBuZWNlc3NhcnkgZm9yIG5vcm1hbCAKCW9wZXJhdGlvbi4gCgoJU01GIHNlcnZp Y2UgZm9yIERhbnRlIFNPQ0tTIHNlcnZlciB3aWxsIGJlIGFkZGVkIHVuZGVyIG5l dHdvcmsgY2F0ZWdvcnkgYXMKCW5ldHdvcmsvc29ja3MuIFRoZSBwYWNrYWdlIHdp bGwgYWRkIHRoZSBtYW5pZmVzdCBmaWxlIGFuZCB0aGUgU01GIG1ldGhvZCBhcyAK CWJlbG93LAoKCS92YXIvc3ZjL21hbmlmZXN0L25ldHdvcmsvc29ja3MueG1sIAoJ L2xpYi9zdmMvbWV0aG9kL3NvY2tzCgoJTWV0aG9kIGNyZWRlbnRpYWxzIGZvciBk YW50ZSBTTUYgc2VydmljZSB3aWxsIGJlICJyb290IiB1c2VyCiAgIAlhbmQgInJv b3QiIGdyb3VwLiBTZWUgU2VjdGlvbiA0LjExIChTZWN1cml0eSBJbXBhY3QpIGZv ciBtb3JlIGRldGFpbHMuCgoJVGhlIFNNRiBzZXJ2aWNlIGZvciBEYW50ZSB3aWxs IGJlIGRpc2FibGVkIGJ5IGRlZmF1bHQuCgoJRGFudGUgc29ja3Mgc2VydmVyIHJl YWRzIHRoZSBjb25maXJndXJhdGlvbiBmaWxlIHdoZW4gc3RhcnRlZC4gVGhlCglj b25maWd1cmF0aW9uIGZpbGUgcmVxdWlyZXMgY2VydGFpbiBwYXJhbWV0ZXJzIHRv IGJlIHNwZWNpZmllZCBmb3IgCgl0aGUgc2VydmVyIHRvIHJ1biAoZS5nLiB0aGUg YWRkcmVzcy9pbnRlcmZhY2UgYW5kIHBvcnQgZm9yIGFsbCB0aGUgCglpbmNvbWlu ZyByZXF1ZXN0cykuIFNpbmNlIHRoZXJlIGNhbm5vdCBiZSBhbnkgcGxhdXNpYmxl IGRlZmF1bHQgdmFsdWUgCgl0byBzdWNoIHBhcmFtZXRlcnMsIHRoZSBjb25maWcg ZmlsZSBzdGlsbCBuZWVkcyB0byBiZSB1c2VkIGFsdGhvdWdoCglpdCBpcyBub3Qg YSByZWNvbW1lbmRlZCBwcmFjdGljZSBmb3IgU01GLiBUaGUgc29ja3Mgc2VydmVy IHdpbGwgZ28KCWludG8gbWFpbnRlbmFuY2UgbW9kZSBpZiBjb25maWd1cmF0aW9u IGZpbGUgaXMgbm90IHVwZGF0ZWQgd2l0aCB2YWxpZAoJdmFsdWVzIHRvIHRoZSBu ZWNlc3NhcnkgcGFyYW1ldGVycy4gCgkKCUhlbmNlLCB0byBlbmFibGUgZGFudGUg c2VydmVyLCBmaXJzdCwgdGhlIC9ldGMvc29ja2QuY29uZiBzaG91bGQKCWJlIHBv cHVsYXRlZCB3aXRoIHZhbGlkIGluZm9ybWF0aW9uIGFuZCB0aGVuLCB0aGUgc2Vy dmljZSBzaG91bGQgYmUgCgllbmFibGVkLiAKCjMuIEJ1c2luZXNzIFN1bW1hcnkK IAogICAzLjEuIFByb2JsZW0gQXJlYToKCglEYW50ZSBwcm92aWRlcyBjb252aW5p ZW50IGFuZCBzZWN1cmUgbmV0d29yayBjb25uZWN0aXZpdHkKCWZyb20gYmVoaW5k IGEgZmlyZXdhbGwgdXNpbmcgU29ja3MgcHJvdG9jb2wuCgoJRGFudGUgaXMgYSBm cmVlIGltcGxlbWVudGF0aW9uIG9mIHRoZSBwcm94eSBwcm90b2NvbHMgc29ja3Mg dmVyc2lvbiA0LAoJc29ja3MgdmVyc2lvbiA1IChyZmMxOTI4KSBhbmQgbXNwcm94 eS4gSXQgY2FuIGJlIHVzZWQgYXMgYSBmaXJld2FsbAoJYmV0d2VlbiBuZXR3b3Jr cy4KCiAgIDMuMi4gTWFya2V0L1JlcXVlc3RlcjoKCglPcGVuU29sYXJpcyBDb21t dW5pdHkKCiAgIDMuMy4gQnVzaW5lc3MgSnVzdGlmaWNhdGlvbjoKCglJbnRlZ3Jh dGlvbiBvZiBEYW50ZSB3aWxsIGFsbG93IHRoZSBTb2xhcmlzIGhvc3QgdG8gYWN0 IGFzIGEgU29ja3Mgc2VydmVyLgoJRGFudGUncyBjbGllbnQgaW1wbGVtZW50YXRp b24gYWxsb3dzIHVzZXJzIHRvIGNvbm5lY3Qgb3V0c2lkZSB0aGVpciBzZWN1cmVk IG5ldHdvcmsgCglpbiBhIHVzZXIgZnJpZW5kbHkgbWFubmVyLiBTdWNoIHNvY2tz IGNsaWVudC1zZXJ2ZXIgaW1wbGVtZW50YXRpb24gaGFzIGJlZW4gCgltaXNzaW5n IGZyb20gIFNvbGFyaXMuCgoJQ3VycmVudGx5LCBpbiBvcmRlciB0byBoYXZlIHNv Y2tzIHNlcnZlci9jbGllbnQgZnVuY3Rpb25hbGl0eSBvbiBTb2xhcmlzLAoJdGhl IHVzZXJzIG5lZWQgdG8gY29tcGlsZS1pbnN0YWxsIGRhbnRlIChvciBzaW1pbGFy IGltcGxlbWVudGF0aW9uKSBvbiB0aGVpciBvd24uCgkKCVRoZSBzZWFtbGVzcyBp bnRlZ3JhdGlvbiBvZiBEYW50ZSB3aXRoIG90aGVyIFNvbGFyaXMgZmVhdHVyZXMg KHN1Y2ggYXMgU01GKQoJd2lsbCBwcm92aWRlIGJldHRlciBvdXQtb2YtdGhlLWJv eCB1c2FiaWxpdHkuCgogICAzLjQuIENvbXBldGl0aXZlIEFuYWx5c2lzOgoKCU1v c3Qgb2YgdGhlIG90aGVyIFVuaXggYmFzZWQgT3BlcmF0aW5nIHN5c3RlbXMgc3Vw cG9ydCBEYW50ZS4KCVRoZSBjb21wZXRpdG9ycyBpbiB0aGlzIHJlZ2FyZCBhcmUg cmVhbGx5IHRoZSBPcGVyYXRpbmcgU3lzdGVtcwoJdGhhdCBpbmNsdWRlIHN1Y2gg ZnVuY3Rpb25hbGl0eSB0b2RheS4KCiAgIDMuNS4gT3Bwb3J0dW5pdHkgV2luZG93 L0V4cG9zdXJlOgoKCVRoZSB0aGlyZCBwYXJ0eSBwcm9kdWN0IGlzIHJlYWR5IHRv IGJlIGludGVncmF0ZWQuCgogICAzLjYuIEhvdyB3aWxsIHlvdSBrbm93IHdoZW4g eW91IGFyZSBkb25lPzoKCglUaGUgcHJvZHVjdCBpcyByZWFkeSB0byBiZSBpbnRl Z3JhdGVkLgoKNC4gVGVjaG5pY2FsIERlc2NyaXB0aW9uOgogICAgNC4xLiBEZXRh aWxzOgoKCWh0dHA6Ly93d3cuaW5ldC5uby9kYW50ZS8KCglEYW50ZSBpcyBhIGNp cmN1aXQtbGV2ZWwgZmlyZXdhbGwvcHJveHkgdGhhdCBjYW4gYmUgdXNlZCB0byBw cm92aWRlIAoJY29udmVuaWVudCBhbmQgc2VjdXJlIG5ldHdvcmsgY29ubmVjdGl2 aXR5IHRvIGEgd2lkZSByYW5nZSBvZiBob3N0cyAKCXdoaWxlIHJlcXVpcmluZyBv bmx5IHRoZSBzZXJ2ZXIgRGFudGUgcnVucyBvbiB0byBoYXZlIGV4dGVybmFsIG5l dHdvcmsgCgljb25uZWN0aXZpdHkuCgoJT25jZSBpbnN0YWxsZWQsIERhbnRlIGNh biBpbiBtb3N0IGNhc2VzIGJlIG1hZGUgdHJhbnNwYXJlbnQgdG8gdGhlIAoJY2xp ZW50cyB3aGlsZSBvZmZlcmluZyBkZXRhaWxlZCBhY2Nlc3MgY29udHJvbCBhbmQg bG9nZ2luZyBmYWNpbGl0aWVzIAoJdG8gdGhlIHNlcnZlciBhZG1pbmlzdHJhdG9y LiAKCiAgICA0LjIuIEJ1Zy9SRkUgTnVtYmVyKHMpOgoKCTY2NjE5NjEKICAgIAog ICAgNC4zLiBJbiBTY29wZToKCiAgICA0LjQuIE91dCBvZiBTY29wZToKICAgIAog ICAgNC41LiBJbnRlcmZhY2VzOgoKCVRoaXMgaW50ZWdyYXRpb24gd2lsbCBub3Qg bW9kaWZ5IG9yIGRlbGV0ZSBhbnkgaW50ZXJmYWNlcy4gSXQgd2lsbAoJYWRkIG9u ZSBiaW5hcnkgZm9yIHRoZSBzZXJ2ZXIgKC91c3Ivc2Jpbi9zb2NrZCkgYW5kIGFu b3RoZXIKCXNjcmlwdCBmb3IgdGhlIGNsaWVudCAoL3Vzci9iaW4vc29ja3NpZnkp LiBJbiBhZGRpdGlvbiwgdGhpcyBwYWNrYWdlIAoJd2lsbCBhbHNvIGFkZCAyIHNo YXJlZCBsaWJyYXJpZXMgYXMgYmVsb3csCgoJL3Vzci9saWIvbGliZHNvY2tzLnNv CgkvdXNyL2xpYi9saWJzb2Nrcy5zbwoJCglUaGUgL3Vzci9iaW4vc29ja3NpZnkg c2NyaXB0IHdpbGwgbG9hZCB0aGUgZHluYW1pYyBsaWJyYXJpZXMgbWVudGlvbmVk CglhYm92ZSB0byAic29ja3NpZnkiIGV4aXN0aW5nIGFwcGxpY2F0aW9ucyB0byBi ZWNvbWUgc29ja3MgY2xpZW50cy4KCglGb3IgdGhlIHNlcnZlciwgL2V0Yy9zb2Nr ZC5jb25mIHdpbGwgYmUgdXNlZCBhcyBhIGNvbmZpZ3VyYXRpb24gZmlsZSwKCWFu ZCBmb3IgdGhlIGNsaWVudCwgL2V0Yy9zb2Nrcy5jb25mIHdpbGwgYmUgdXNlZCBm b3IgY29uZmlndXJhdGlvbi4KCglUaGlzIHBhY2thZ2Ugd2lsbCBub3QgaW1wb3J0 IGFueSBpbnRlcmZhY2VzLCB0aGUgZXhwb3J0ZWQgaW50ZXJmYWNlcyAKCWNhbiBi ZSBzdW1tYXJpemVkIGluIHRoZSBmb2xsb3dpbmcgbWFubmVyLAoKCSArLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsgIAoJIHwgICB8IEludGVyZmFjZSBOYW1l ICAgICAgfCBDbGFzc2lmaWNhdGlvbiAgICAgICB8IENvbW1lbnRzICAgICAgICAg ICAgICAgICAgfAoJIHwtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tfAoJIHwg MSB8IGxpYmRzb2Nrcy5zbyAgICAgICAgfCBQcm9qZWN0IFByaXZhdGUJICB8IFNP Q0tTIGRhZW1vbiBsaWJyYXJ5ICAgICAgfAoJIHwgICB8LS0tLS0tLS0tLS0tLS0t LS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tfCAKCSB8IDIgfCBsaWJzb2Nrcy5zbyAgICAgICAgIHwgQ29tbWl0 dGVkIAkJICB8IFNPQ0tTIGxpYnJhcnkgICAgICAgICAgICAgfCAgCgkgfCAgIHwt LS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS18IAoJIHwgMyB8IHNvY2tzaWZ5ICAgICAg ICAgICAgfCBVbmNvbW1pdHRlZCAJICB8IFNPQ0tTIGNsaWVudCBzY3JpcHQgICAg ICAgfCAKCSB8ICAgfC0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLXwgCgkgfCA0IHwg c29ja2QgICAgICAgICAgICAgICB8IFVuY29tbWl0dGVkIAkgIHwgU09DS1Mgc2Vy dmVyIGRhZW1vbiAgICAgICB8ICAKCSB8ICAgfC0tLS0tLS0tLS0tLS0tLS0tLS0t LSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLXwgCgkgfCA1IHwgc29ja3MuY29uZiAgICAgICAgICB8IFVuY29tbWl0dGVk IAkgIHwgQ2xpZW50IGNvbmZpZ3VyYXRpb24gZmlsZSB8IAoJIHwgICB8LS0tLS0t LS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tfCAKCSB8IDYgfCBzb2NrZC5jb25mICAgICAgICAg IHwgVW5jb21taXR0ZWQgCSAgfCBTZXJ2ZXIgY29uZmlndXJhdGlvbiBmaWxlIHwg IAoJIHwgICB8LS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tfCAKCSB8IDcgfCBTVU5X bGlic29ja3MJICAgfCBQdWJsaWMvQ29tbWl0dGVkICAgICB8IENsaWVudCBwYWNr YWdlIAkgICAgICB8IAoJIHwgICB8LS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tfCAK CSB8IDggfCBTVU5XZGFudGV1CSAgIHwgUHVibGljL0NvbW1pdHRlZCAgICAgfCBT ZXJ2ZXIgcGFja2FnZSAoVXNlcikgICAgIHwKCSB8ICAgfC0tLS0tLS0tLS0tLS0t LS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLXwgCgkgfCA5IHwgU1VOV2RhbnRlcgkgICB8IFB1YmxpYy9Db21t aXR0ZWQgICAgIHwgU2VydmVyIHBhY2thZ2UgKFJvb3QpICAgICB8ICAKCSB8ICAg fC0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLXwgCgkgfDEwIHwgbmV0d29yay9zb2Nr cwkgICB8IFB1YmxpYy9Db21taXR0ZWQgICAgIHwgU01GIFNlcnZpY2UgbmFtZSAg ICAgICAgICB8ICAKCSB8ICAgfC0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLXwgCgkg fDExIHwgc29ja2QJICAgCSAgIHwgVW5jb21taXR0ZWQgICAgICAgICAgfCBQQU0g U2VydmljZW5hbWUgICAgICAgICAgIHwgIAoJICstLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tKyAgICAgICAgICAgICAgICAgICAKCiAgICAKICAgIDQuNi4gRG9j IEltcGFjdDoKCVRoaXMgaW50ZWdyYXRpb24gd2lsbCBjb3JyZWN0bHkgYWRkIG1h biBlbnRyaWVzLiBOb25lIG9mIHRoZSBleGlzdGluZyBtYW4KICAgICAgICBlbnRy aWVzIHdpbGwgYmUgdG91Y2hlZC4gVGhlIG5ldyBtYW4gZW50cmllcyBhcmUgYXMg YmVsb3csCgoJL3Vzci9tYW4vbWFuMW0vc29ja2QuMW0KCS91c3IvbWFuL21hbjEv c29ja3NpZnkuMQoJL3Vzci9tYW4vbWFuNC9zb2NrZC5jb25mLjQKCS91c3IvbWFu L21hbjQvc29ja3MuY29uZi40CiAKICAgIDQuNy4gQWRtaW4vQ29uZmlnIEltcGFj dDoKICAgCglUaGUgcGFja2FnZSB3aWxsIGFsc28gcHJvdmlkZSB0ZW1wbGF0ZSBv ZiBjb25maWd1cmF0aW9uIGZpbGVzCglmb3IgYm90aCBzZXJ2ZXIgYW5kIGNsaWVu dC4gVGhlIHRlbXBsYXRlcyBmb3IgdGhlc2UgY29uZmlndXJlYXRpb24KCWZpbGVz IGFyZSBhdHRhY2hlZC4KCgkvZXRjL3NvY2tkLmNvbmYKCS9ldGMvc29ja3MuY29u ZgoKICAgIDQuOC4gSEEgSW1wYWN0OgoJTi9BCiAgICAKICAgIDQuOS4gSTE4Ti9M MTBOIEltcGFjdDoKCU5vbmUuIFRoZSBlcnJvciBtZXNzYWdlcyBhcmUgbm90IGxv Y2FsaXplZC4KICAgIAogICAgNC4xMC4gUGFja2FnaW5nICYgRGVsaXZlcnk6CglC b3RoIHNlcnZlciBhbmQgY2xpZW50IHdpbGwgYmUgaW5zdGFsbGVkIHdpdGggZm9s bG93aW5nIHBhY2thZ2VzLgoKCVNVTldsaWJzb2NrcwlEYW50ZSAtIEEgU29ja3Mg Y2xpZW50IGltcGxlbWVudGF0aW9uCglTVU5XZGFudGVyCURhbnRlIC0gQSBTb2Nr cyBzZXJ2ZXIgaW1wbGVtZW50YXRpb24sIFJvb3QKCVNVTldkYW50ZXUJRGFudGUg LSBBIFNvY2tzIHNlcnZlciBpbXBsZW1lbnRhdGlvbiwgVXNlcgoKICAgIDQuMTEu IFNlY3VyaXR5IEltcGFjdDoKCglTb2NrcyBTZXJ2ZXIgYW5kIGNsaWVudCB3aWxs IGRlcGVuZCBvbiB0aGUgcG9ydCBjb25maWd1cmVkIGluIHRoZSByZXNwZWN0aXZl IAoJY29uZmlndXJhdGlvbiBmaWxlIGZvciBuZXR3b3JrIGNvbm5lY3Rpdml0eS4K CglUaGUgc2VydmVyIGNvbmZpZ3VyYXRpb24gZmlsZSBkZWZpbmVzIHR3byB2YXJp YWJsZXMgYXMsIHVzZXIucHJpdmlsZWdlZCBhbmQgCgl1c2VyLm5vdHByaXZpbGVn ZWQuIFRoZXNlIDIgdmFyaWFibGVzIGNhbiBoYXZlIGEgbGlzdCBvZiB1c2VyaWRz IHNlcGFyYXRlZCAKCWJ5IGNvbW1hLiBUaGUgc2VydmVyIGltcGxlbWVudGF0aW9u IGNhbGxzIHNldGV1aWQgZnVuY3Rpb24gdG8gc3dpdGNoIGJldHdlZW4gCglwcml2 aWxlZ2VkIGFuZCBub3Rwcml2aWxlZ2VkIHVzZXJzLiBVcG9uIHN0YXJ0LCB0aGUg c2VydmVyIHN3aXRjaGVzIHRoZSBlZmZlY3RpdmUgCglpZCBmcm9tIHRoZSB1c2Vy IHdobyBzdGFydGVkIHRoZSBiaW5hcnkgdG8gdGhlIHNwZWNpZmllZCB1c2VyLm5v dHByaXZpbGVnZWQuIAoJTGF0ZXIsIGZvciBhbGwgdGhlIHByaXZpbGVnZWQgb3Bl cmF0aW9ucyAoZS5nLiBQQU0gYXV0aGVudGljYXRpb24pLCAKCXRoZSBzZXJ2ZXIg c2V0cyB0aGUgZWZmZWN0aXZlIHVzZXIgSUQgZnJvbSB1c2VyLm5vdHByaXZpbGVn ZWQgdG8gc3BlY2lmaWVkCgl1c2VyLnByaXZpbGVnZWQgYnkgY2FsbGluZyBzZXRl dWlkIGZ1bmN0aW9uLiAKCglUaGUgYmVoYXZpb3IgYXMgZGVzY3JpYmVkIGFib3Zl IGlzIG5vdCBhIHJlY29tbWVuZGVkIHByYWN0aWNlIHdpdGggU29sYXJpcy4gSW5z dGVhZAoJb2Ygc3dpdGNoaW5nIGJldHdlZW4gdXNlciBJRHMgZm9yIHByaXZpbGVn ZWQgYW5kIG5vbi1wcml2aWxlZ2VkIG9wZXJhdGlvbnMsCglTb2xhcmlzIHJlY29t bWVuZHMgdG8gYWNxdWlyZSBhbmQgcmVsZWFzZSBzcGVjaWZpYyBwcml2aWxlZ2Vz IGZvciBzdWNoIHByaXZpbGVnZWQgCglhY3Rpb25zIHdoaWNoIHByb3ZpZGUgYmV0 dGVyIGFuZCBmaW5lIGdyYWluZWQgY29udHJvbC4KCglIb3dldmVyLCB0aGUgZGFu dGUgc2VydmVyIGltcGxlbWVudGF0aW9uIGRvZXMgbm90IHVzZSB0aGUgcHJpdmls ZWdlIG1lY2hhbmlzbSAKCWFuZCBkZXBlbmRzIG9uIHRoZSAyIHVzZXJzIGRlZmlu ZWQgaW4gdGhlIGNvbmZpZ3VyYXRpb24gZmlsZS4KCQoJVGhlIGRlZmF1bHQvc2Ft cGxlIGNvbmZpZ3VyYXRpb24gZmlsZSB3aWxsIGhhdmUgdXNlci5ub3Rwcml2aWxl Z2VkIGFzICdkYWVtb24nIAoJYW5kIHRoZSB1c2VyLnByaXZpbGVnZWQgd2lsbCBi ZSBzZXQgdG8gJ3Jvb3QnLiBUaGUgcmVhc29uIHdoeSB1c2VyLnByaXZpbGVnZWQK CW5lZWQgdG8gYmUgcm9vdCBpcyBiZWNhdXNlIHBhbV9hdXRoZW50aWNhdGUoM3Bh bSkgcmVxdWlyZXMgYWxsIHByaXZpbGVnZXMgYW5kCgl1c2VyIElEIGFzIDAuCgoJ QnkgZGVmYXVsdCwgRGFudGUgc2VydmVyIHdpbGwgdXNlIHBvcnQgMTA4MCwgdGhl IHBvcnQgY2FuIGJlIGNvbmZpZ3VyZWQgaW4KCS9ldGMvc29ja2QuY29uZiBmaWxl LiBQbGVhc2Ugbm90ZSB0aGF0IGlmIGEgcmVzZXJ2ZWQgcG9ydCBpcyBjb25maWd1 cmVkIHRoZW4KCXRoZSBkYW50ZSBzZXJ2ZXIgd2lsbCBiaW5kIHRvIGl0IHN1Y2Nl c3NmdWxseSwgYXMgdGhlIHVzZXIucHJpdmlsZWdlZCBpcyAKCXNldCB0byAncm9v dCcuCgogICAgNC4xMS4xIFBBTSBBdXRoZW50aWNhdGlvbgogICAgCglEYW50ZSBz ZXJ2ZXIgY29uZmlybXMgdG8gdGhlIFBBTSBwb2xpY3kgc3BlY2lmaWVkIGZvciB0 aGUgVXNlciBJZGVudGlmaWNhdGlvbiBhbmQKCUF1dGhlbnRpY2F0aW9uLiBEdXJp bmcgYXV0aGVudGljYXRpb24sIHRoZSBzZXJ2ZXIgbWFrZXMgY2FsbHMgdG8gZm9s bG93aW5nIGZ1bmN0aW9ucwoJaW4gb3JkZXIsCgkJcGFtX3N0YXJ0KCkKCQlwYW1f c2V0X2l0ZW0oKQoJCXBhbV9hdXRoZW50aWNhdGUoKQoJCXBhbV9hY2N0X21nbXQo KQoJCXBhbV9lbmQoKQoKCVBsZWFzZSBub3RlIHRoYXQgYmVmb3JlIHN0YXJ0aW5n IHRoZSBwYW0gYXV0aGVudGljYXRpb24sIGRhbnRlIHNlcnZlciBjYWxscyBzZXRl dWlkKCkKCXRvIHN3aXRjaCB0byB0aGUgc3BlY2lmaWVkIHByaXZpbGVnZWQgdXNl ci4gSW4gU29sYXJpcywgUEFNIHJlcXVpcmVzIGFsbCBwcml2aWxlZ2VzIAoJYW5k IHVzZXIgSUQgMCBhbmQgaGVuY2UgaXQgaXMgbmVjZXNzYXJ5IHRoYXQgdXNlci5w cml2aWxlZ2VkIHNob3VsZCBiZSBzZXQgdG8gJ3Jvb3QnCglpbiB0aGUgL2V0Yy9z b2NrZC5jb25mIGZpbGUuCgogICAgNC4xMi4gRGVwZW5kZW5jaWVzOgoKCVRoZSBz b2NrcyBzZXJ2ZXIgbWFpbmx5IGRlcGVuZHMgb24gdGhlIGF2YWlsYWJsZSBzdXBw b3J0IGZvciBQQU0uCglUaGUgZGV0YWlscyBvZiBkZXBlbmRlbmNpZXMgYXJlIGFz IGJlbG93LAoKCWJhc2gtMy4wMCMgbGRkIGxpYnNvY2tzLnNvCiAgICAgICAgbGli cGFtLnNvLjEgPT4gICAvbGliL2xpYnBhbS5zby4xCiAgICAgICAgbGlic29ja2V0 LnNvLjEgPT4gICAgICAgIC9saWIvbGlic29ja2V0LnNvLjEKICAgICAgICBsaWJu c2wuc28uMSA9PiAgIC9saWIvbGlibnNsLnNvLjEKICAgICAgICBsaWJyZXNvbHYu c28uMiA9PiAgICAgICAgL2xpYi9saWJyZXNvbHYuc28uMgogICAgICAgIGxpYmMu c28uMSA9PiAgICAgL2xpYi9saWJjLnNvLjEKICAgICAgICBsaWJtcC5zby4yID0+ ICAgIC9saWIvbGlibXAuc28uMgogICAgICAgIGxpYm1kLnNvLjEgPT4gICAgL2xp Yi9saWJtZC5zby4xCiAgICAgICAgbGlic2NmLnNvLjEgPT4gICAvbGliL2xpYnNj Zi5zby4xCiAgICAgICAgbGlidXV0aWwuc28uMSA9PiAgICAgICAgIC9saWIvbGli dXV0aWwuc28uMQogICAgICAgIGxpYmdlbi5zby4xID0+ICAgL2xpYi9saWJnZW4u c28uMQogICAgICAgIGxpYm0uc28uMiA9PiAgICAgL2xpYi9saWJtLnNvLjIKCglU aGUgb3V0cHV0IG9mIGxkZCBjb21tYW5kIGZvciBsaWJkc29ja3Muc28gc2hvd3Mg ZXhhY3RseSB0aGUgc2FtZSBvdXRwdXQKCWFzIGFib3ZlLgoKCWJhc2gtMy4wMCMg bGRkIC91c3Ivc2Jpbi9zb2NrZCAKICAgICAgICBsaWJ3cmFwLnNvLjEgPT4gIC91 c3IvbGliL2xpYndyYXAuc28uMQogICAgICAgIGxpYnBhbS5zby4xID0+ICAgL2xp Yi9saWJwYW0uc28uMQogICAgICAgIGxpYnNvY2tldC5zby4xID0+ICAgICAgICAv bGliL2xpYnNvY2tldC5zby4xCiAgICAgICAgbGlibnNsLnNvLjEgPT4gICAvbGli L2xpYm5zbC5zby4xCiAgICAgICAgbGlicmVzb2x2LnNvLjIgPT4gICAgICAgIC9s aWIvbGlicmVzb2x2LnNvLjIKICAgICAgICBsaWJjLnNvLjEgPT4gICAgIC9saWIv bGliYy5zby4xCiAgICAgICAgbGlibXAuc28uMiA9PiAgICAvbGliL2xpYm1wLnNv LjIKICAgICAgICBsaWJtZC5zby4xID0+ICAgIC9saWIvbGlibWQuc28uMQogICAg ICAgIGxpYnNjZi5zby4xID0+ICAgL2xpYi9saWJzY2Yuc28uMQogICAgICAgIGxp YnV1dGlsLnNvLjEgPT4gICAgICAgICAvbGliL2xpYnV1dGlsLnNvLjEKICAgICAg ICBsaWJnZW4uc28uMSA9PiAgIC9saWIvbGliZ2VuLnNvLjEKICAgICAgICBsaWJt LnNvLjIgPT4gICAgIC9saWIvbGlibS5zby4yCgoJVGhlIFNNRiBzZXJ2aWNlIGZv ciBEYW50ZSBzZXJ2ZXIgZG9lcyBub3QgZGVwZW5kIG9uIGFueSBvdGhlciBzcGVj aWZpYyAKCXNlcnZpY2UuCgo1LiBSZWZlcmVuY2UgRG9jdW1lbnRzOgoKCWh0dHA6 Ly93d3cuaW5ldC5uby9kYW50ZS8KCjYuIFJlc291cmNlcyBhbmQgU2NoZWR1bGU6 CiAgIDYuMS4gUHJvamVjdGVkIEF2YWlsYWJpbGl0eToKCglJbnRlZ3JhdGlvbiB0 YXJnZXRlZCBmb3IgSW5kaWFuYSByZWxlYXNlLgoKICAgNi4yLiBDb3N0IG9mIEVm Zm9ydDoKCglNaW5pbXVtLiBPbmUgcmVzb3VyY2UgZm9yIGludGVncmF0aW9uIGlu IFNGVyBjb25zb2xpZGF0aW9uLgkKCiAgIDYuMy4gQ29zdCBvZiBDYXBpdGFsIFJl c291cmNlczoKCU5vbmUKCiAgIDYuNC4gUHJvZHVjdCBBcHByb3ZhbCBDb21taXR0 ZWUgcmVxdWVzdGVkIGluZm9ybWF0aW9uOgogICAJNi40LjEuIENvbnNvbGlkYXRp b24gb3IgQ29tcG9uZW50IE5hbWU6CgkJU0ZXCgoJNi40LjMuIFR5cGUgb2YgQ1BU IFJldmlldyBhbmQgQXBwcm92YWwgZXhwZWN0ZWQ6CgkJRkFTVFRSQUNLCgogICAg ICAgIDYuNC40LiBQcm9qZWN0IEJvdW5kYXJ5IENvbmRpdGlvbnM6CgkJTm9uZQoK CTYuNC41LiBJcyB0aGlzIGEgbmVjZXNzYXJ5IHByb2plY3QgZm9yIE9FTSBhZ3Jl ZW1lbnRzOgoJCU5vCgoJNi40LjYuIE5vdGVzOgoKCTYuNC43LiBUYXJnZXQgUlRJ IERhdGUvUmVsZWFzZToKCQlJbmRpYW5hIFJlbGVhc2UKCgk2LjQuOC4gVGFyZ2V0 IENvZGUgRGVzaWduIFJldmlldyBEYXRlOgoJNi40LjkuIFVwZGF0ZSBhcHByb3Zh bCBhZGRpdGlvbjoKCiAgIDYuNS4gQVJDIHJldmlldyB0eXBlOgoJCUZhc3RUcmFj awoKICAgNi42LiBBUkMgRXhwb3N1cmU6CgkJT1BFTgoKICAgICAgIDYuNi4xLiBS YXRpb25hbGU6Cgo3LiBQcm90b3R5cGUgQXZhaWxhYmlsaXR5OgogICA3LjEuIFBy b3RvdHlwZSBBdmFpbGFiaWxpdHk6CglOL0EKCiAgIDcuMi4gUHJvdG90eXBlIENv c3Q6CglOL0EKCiB8LS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tfCAKCSB8IDUgfCBz b2Nrcy5jb25mICAgICAgICAgIHwgVW5jb21taXR0ZWQgCSAgfCBDbGllbnQgY29u ZmlndXJhdGlvbiBmaWxlIG1hdGVyaWFsL3NvY2tkLmNvbmYAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwNjAwADA0MDcxNTYAMDAwMDAxMgAwMDAw MDAxNjcwNAAxMTExNTQ0NTI3MAAwMDE1MTM1ADAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdXN0YXIAMDBtbjEzMzc2 NgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHN0YWZmAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAMDAwMDE0NgAwMDAwMDAzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA IyAkSWQ6IHNvY2tkLmNvbmYsdiAxLjQzIDIwMDUvMTIvMjYgMTY6MzU6MjYgbWlj aGFlbHMgRXhwICQKIwojIEEgc2FtcGxlIHNvY2tkLmNvbmYKIwojCiMgVGhlIGNv bmZpZ2ZpbGUgaXMgZGl2aWRlZCBpbnRvIHRocmVlIHBhcnRzOyAKIyAgICAxKSBz ZXJ2ZXJzZXR0aW5ncwojICAgIDIpIHJ1bGVzCiMgICAgMykgcm91dGVzCiMKIyBU aGUgcmVjb21tZW5kZWQgb3JkZXIgaXM6CiMgICBTZXJ2ZXJzZXR0aW5nczoKIyAg ICAgICAgICAgICAgIGxvZ291dHB1dAojICAgICAgICAgICAgICAgaW50ZXJuYWwK IyAgICAgICAgICAgICAgIGV4dGVybmFsCiMgICAgICAgICAgICAgICBtZXRob2QK IyAgICAgICAgICAgICAgIGNsaWVudG1ldGhvZAojICAgICAgICAgICAgICAgdXNl cnMKIyAgICAgICAgICAgICAgIGNvbXBhdGliaWxpdHkKIyAgICAgICAgICAgICAg IGV4dGVuc2lvbgojICAgICAgICAgICAgICAgY29ubmVjdHRpbWVvdXQKIyAgICAg ICAgICAgICAgIGlvdGltZW91dAojCQlzcmNob3N0CiMKIyAgUnVsZXM6CiMJY2xp ZW50IGJsb2NrL3Bhc3MKIwkJZnJvbSB0bwojCQlsaWJ3cmFwCiMJCWxvZwojCiMg ICAgIGJsb2NrL3Bhc3MKIwkJZnJvbSB0bwojCQltZXRob2QKIwkJY29tbWFuZAoj CQlsaWJ3cmFwCiMJCWxvZwojCQlwcm90b2NvbAojCQlwcm94eXByb3RvY29sCiMK IyAgUm91dGVzOiAKCiMgdGhlIHNlcnZlciB3aWxsIGxvZyBib3RoIHZpYSBzeXNs b2csIHRvIHN0ZG91dCBhbmQgdG8gL3Zhci9sb2cvbG90c29mbG9ncwojbG9nb3V0 cHV0OiBzeXNsb2cgc3Rkb3V0IC92YXIvbG9nL2xvdHNvZmxvZ3MKbG9nb3V0cHV0 OiBzdGRlcnIKCiMgVGhlIHNlcnZlciB3aWxsIGJpbmQgdG8gdGhlIGFkZHJlc3Mg MTAuMS4xLjEsIHBvcnQgMTA4MCBhbmQgd2lsbCBvbmx5CiMgYWNjZXB0IGNvbm5l Y3Rpb25zIGdvaW5nIHRvIHRoYXQgYWRkcmVzcy4KI2ludGVybmFsOiAxMC4xLjEu MSBwb3J0ID0gMTA4MAojIEFsdGVybmF0aXZlbHksIHRoZSBpbnRlcmZhY2UgbmFt ZSBjYW4gYmUgdXNlZCBpbnN0ZWFkIG9mIHRoZSBhZGRyZXNzLgojaW50ZXJuYWw6 IGV0aDAgcG9ydCA9IDEwODAKCiMgYWxsIG91dGdvaW5nIGNvbm5lY3Rpb25zIGZy b20gdGhlIHNlcnZlciB3aWxsIHVzZSB0aGUgSVAgYWRkcmVzcwojIDE5NS4xNjgu MS4xCiNleHRlcm5hbDogMTkyLjE2OC4xLjEKCiMgbGlzdCBvdmVyIGFjY2VwdGFi bGUgbWV0aG9kcywgb3JkZXIgb2YgcHJlZmVyZW5jZS4KIyBBIG1ldGhvZCBub3Qg c2V0IGhlcmUgd2lsbCBuZXZlciBiZSBzZWxlY3RlZC4KIwojIElmIHRoZSBtZXRo b2QgZmllbGQgaXMgbm90IHNldCBpbiBhIHJ1bGUsIHRoZSBnbG9iYWwKIyBtZXRo b2QgaXMgZmlsbGVkIGluIGZvciB0aGF0IHJ1bGUuCiMKCiMgbWV0aG9kcyBmb3Ig c29ja3MtcnVsZXMuCiNtZXRob2Q6IHVzZXJuYW1lIG5vbmUgI3JmYzkzMQoKIyBt ZXRob2RzIGZvciBjbGllbnQtcnVsZXMuCiNjbGllbnRtZXRob2Q6IG5vbmUKCiNv ciBpZiB5b3Ugd2FudCB0byBhbGxvdyByZmM5MzEgKGlkZW50KSB0b28KI21ldGhv ZDogdXNlcm5hbWUgcmZjOTMxIG5vbmUKCiNvciBmb3IgUEFNIGF1dGhlbnRpZmlj YXRpb24KI21ldGhvZDogcGFtCgojCiMgQW4gaW1wb3J0YW50IHNlY3Rpb24sIHBh eSBhdHRlbnRpb24uCiMKCiMgd2hlbiBkb2luZyBzb21ldGhpbmcgdGhhdCBjYW4g cmVxdWlyZSBwcml2aWxlZ2UsIGl0IHdpbGwgdXNlIHRoZQojIHVzZXJpZCAic29j a2QiLgojdXNlci5wcml2aWxlZ2VkOiBzb2NrZAoKIyB3aGVuIHJ1bm5pbmcgYXMg dXN1YWwsIGl0IHdpbGwgdXNlIHRoZSB1bnByaXZpbGVnZWQgdXNlcmlkIG9mICJz b2NrZCIuCiN1c2VyLm5vdHByaXZpbGVnZWQ6IHNvY2tkCgojIElmIHlvdSBjb21w aWxlZCB3aXRoIGxpYndyYXAgc3VwcG9ydCwgd2hhdCB1c2VyaWQgc2hvdWxkIGl0 IHVzZQojIHdoZW4gZXhlY3V0aW5nIHlvdXIgbGlid3JhcCBjb21tYW5kcz8gICJs aWJ3cmFwIi4KI3VzZXIubGlid3JhcDogbGlid3JhcAoKCiMKIyBzb21lIG9wdGlv bnMgdG8gaGVscCBjbGllbnRzIHdpdGggY29tcGF0aWJpbGl0eToKIwoKIyB3aGVu IGEgY2xpZW50IGNvbm5lY3Rpb24gY29tZXMgaW4gdGhlIHNvY2tzc2VydmVyIHdp bGwgdHJ5IHRvIHVzZQojIHRoZSBzYW1lIHBvcnQgYXMgdGhlIGNsaWVudCBpcyB1 c2luZywgd2hlbiB0aGUgc29ja3NzZXJ2ZXIKIyBnb2VzIG91dCBvbiB0aGUgY2xp ZW50cyBiZWhhbGYgKGV4dGVybmFsOiBJUCBhZGRyZXNzKS4KIyBJZiB0aGlzIG9w dGlvbiBpcyBzZXQsIERhbnRlIHdpbGwgdHJ5IHRvIGRvIGl0IGZvciByZXNlcnZl ZCBwb3J0cyBhc3dlbGwuCiMgVGhpcyB3aWxsIHVzdWFsbHkgcmVxdWlyZSB1c2Vy LnByaXZpbGVnZWQgdG8gYmUgc2V0IHRvICJyb290Ii4KI2NvbXBhdGliaWxpdHk6 IHNhbWVwb3J0CgojIElmIHlvdSBhcmUgdXNpbmcgdGhlIGJpbmQgZXh0ZW5zaW9u IGFuZCBoYXZlIHRyb3VibGUgcnVubmluZyBzZXJ2ZXJzCiMgdmlhIHRoZSBzZXJ2 ZXIsIHlvdSBtaWdodCB0cnkgc2V0dGluZyB0aGlzLiAgVGhlIGNvbnNlcXVlbmNl cyBvZiBpdAojIGFyZSB1bmtub3duLgojY29tcGF0aWJpbGl0eTogcmV1c2VhZGRy CgojCiMgVGhlIERhbnRlIHNlcnZlciBzdXBwb3J0cyBzb21lIGV4dGVuc2lvbnMg dG8gdGhlIHNvY2tzIHByb3RvY29sLgojIFRoZXNlIHJlcXVpcmUgdGhhdCB0aGUg c29ja3MgY2xpZW50IGltcGxlbWVudHMgdGhlIHNhbWUgZXh0ZW5zaW9uIGFuZAoj IGNhbiBiZSBlbmFibGVkIHVzaW5nIHRoZSAiZXh0ZW5zaW9uIiBrZXl3b3JkLgoj CiMgZW5hYmxlIHRoZSBiaW5kIGV4dGVuc2lvbi4KI2V4dGVuc2lvbjogYmluZAoK CiMKIwojIG1pc2Mgb3B0aW9ucy4KIwoKIyBob3cgbWFueSBzZWNvbmRzIGNhbiBw YXNzIGZyb20gd2hlbiBhIGNsaWVudCBjb25uZWN0cyB0aWwgaXQgaGFzCiMgc2Vu dCB1cyBpdCdzIHJlcXVlc3Q/ICBBZGp1c3QgYWNjb3JkaW5nIHRvIHlvdXIgbmV0 d29yayBwZXJmb3JtYW5jZQojIGFuZCBtZXRob2RzIHN1cHBvcnRlZC4KI2Nvbm5l Y3R0aW1lb3V0OiAzMCAgICMgb24gYSBsYW4sIHRoaXMgc2hvdWxkIGJlIGVub3Vn aCBpZiBtZXRob2QgaXMgIm5vbmUiLgoKIyBob3cgbWFueSBzZWNvbmRzIGNhbiB0 aGUgY2xpZW50IGFuZCBpdCdzIHBlZXIgaWRsZSB3aXRob3V0IHNlbmRpbmcKIyBh bnkgZGF0YSBiZWZvcmUgd2UgZHVtcCBpdD8gIFVubGVzcyB5b3UgZGlzYWJsZSB0 Y3Aga2VlcC1hbGl2ZSBmb3IKIyBzb21lIHJlYXNvbiwgaXQncyBwcm9iYWJseSBi ZXN0IHRvIHNldCB0aGlzIHRvIDAsIHdoaWNoIGlzCiMgImZvcmV2ZXIiLgojaW90 aW1lb3V0OiAwICMgb3IgcGVyaGFwcyA4NjQwMCwgZm9yIGEgZGF5LgoKIyBkbyB5 b3Ugd2FudCB0byBhY2NlcHQgY29ubmVjdGlvbnMgZnJvbSBhZGRyZXNzZXMgd2l0 aG91dAojIGRucyBpbmZvPyAgd2hhdCBhYm91dCBhZGRyZXNzZXMgaGF2aW5nIGEg bWlzbWF0Y2ggaW4gZG5zaW5mbz8KI3NyY2hvc3Q6IG5vdW5rbm93biBub21pc21h dGNoCgojCiMgVGhlIGFjdHVhbCBydWxlcy4gIFRoZXJlIGFyZSB0d28ga2luZHMg YW5kIHRoZXkgd29yayBhdCBkaWZmZXJlbnQgbGV2ZWxzLgojCiMgVGhlIHJ1bGVz IHByZWZpeGVkIHdpdGggImNsaWVudCIgYXJlIGNoZWNrZWQgZmlyc3QgYW5kIHNh eSB3aG8gaXMgYWxsb3dlZAojIGFuZCB3aG8gaXMgbm90IGFsbG93ZWQgdG8gc3Bl YWsvY29ubmVjdCB0byB0aGUgc2VydmVyLiAgSS5lIHRoZQojIGlwIHJhbmdlIGNv bnRhaW5pbmcgcG9zc2libHkgdmFsaWQgY2xpZW50cy4KIyBJdCBpcyBlc3BlY2lh bGx5IGltcG9ydGFudCB0aGF0IHRoZXNlIG9ubHkgdXNlIElQIGFkZHJlc3Nlcywg bm90IGhvc3RuYW1lcywKIyBmb3Igc2VjdXJpdHkgcmVhc29ucy4KIwojIFRoZSBy dWxlcyB0aGF0IGRvIG5vdCBoYXZlIGEgImNsaWVudCIgcHJlZml4IGFyZSBjaGVj a2VkIGxhdGVyLCB3aGVuIHRoZQojIGNsaWVudCBoYXMgc2VudCBpdHMgcmVxdWVz dCBhbmQgYXJlIHVzZWQgdG8gZXZhbHVhdGUgdGhlIGFjdHVhbAojIHJlcXVlc3Qu CiMKIyBUaGUgInRvOiIgaW4gdGhlICJjbGllbnQiIGNvbnRleHQgZ2l2ZXMgdGhl IGFkZHJlc3MgdGhlIGNvbm5lY3Rpb24KIyBpcyBhY2NlcHRlZCBvbiwgaS5lIHRo ZSBhZGRyZXNzIHRoZSBzb2Nrc3NlcnZlciBpcyBsaXN0ZW5pbmcgb24sIG9yCiMg anVzdCAiMC4wLjAuMC8wIiBmb3IgYW55IGFkZHJlc3MgdGhlIHNlcnZlciBpcyBs aXN0ZW5pbmcgb24uCiMKIyBUaGUgInRvOiIgaW4gdGhlIG5vbi0iY2xpZW50IiBj b250ZXh0IGdpdmVzIHRoZSBkZXN0aW5hdGlvbiBvZiB0aGUgY2xpZW50cwojIHNv Y2tzcmVxdWVzdC4KIwojICJmcm9tOiIgaXMgdGhlIHNvdXJjZSBhZGRyZXNzIGlu IGJvdGggY29udGV4dHMuCiMKCgojIHRoZSAiY2xpZW50IiBydWxlcy4gIEFsbCBv dXIgY2xpZW50cyBjb21lIGZyb20gdGhlIG5ldCAxMC4wLjAuMC84LgojCgojIEFs bG93IG91ciBjbGllbnRzLCBhbHNvIHByb3ZpZGVzIGFuIGV4YW1wbGUgb2YgdGhl IHBvcnQgcmFuZ2UgY29tbWFuZC4KI2NsaWVudCBwYXNzIHsKIwlmcm9tOiAxMC4w LjAuMC84IHBvcnQgMS02NTUzNSB0bzogMC4wLjAuMC8wCiMJbWV0aG9kOiByZmM5 MzEgIyBtYXRjaCBhbGwgaWRlbnRlZCB1c2VycyB0aGF0IGFsc28gYXJlIGluIHBh c3N3b3JkZmlsZQojfQoKIyBUaGlzIGlzIGlkZW50aWNhbCB0byBhYm92ZSwgYnV0 IGFsbG93cyBjbGllbnRzIHdpdGhvdXQgYSByZmM5MzEgKGlkZW50KQojIHRvby4g IEluIHByYWN0aXNlIHRoaXMgbWVhbnMgdGhlIHNvY2tzc2VydmVyIHdpbGwgdHJ5 IHRvIGdldCBhIHJmYzkzMQojIHJlcGx5IGZpcnN0ICh0aGUgYWJvdmUgcnVsZSks IGlmIHRoYXQgZmFpbHMsIGl0IHRyaWVzIHRoaXMgcnVsZS4KI2NsaWVudCBwYXNz IHsKIwlmcm9tOiAxMC4wLjAuMC84IHBvcnQgMS02NTUzNSB0bzogMC4wLjAuMC8w CiN9CgoKIyBkcm9wIGV2ZXJ5b25lIGVsc2UgYXMgc29vbiBhcyB3ZSBjYW4gYW5k IGxvZyB0aGUgY29ubmVjdCwgdGhleSBhcmUgbm90CiMgb24gb3VyIG5ldCBhbmQg aGF2ZSBubyBidXNpbmVzcyBjb25uZWN0aW5nIHRvIHVzLiAgVGhpcyBpcyB0aGUg ZGVmYXVsdAojIGJ1dCBpZiB5b3UgZ2l2ZSB0aGUgcnVsZSB5b3Vyc2VsZiwgeW91 IGNhbiBzcGVjaWZ5IGRldGFpbHMuCiNjbGllbnQgYmxvY2sgewojCWZyb206IDAu MC4wLjAvMCB0bzogMC4wLjAuMC8wCiMJbG9nOiBjb25uZWN0IGVycm9yCiN9CgoK IyB0aGUgcnVsZXMgY29udHJvbGxpbmcgd2hhdCBjbGllbnRzIGFyZSBhbGxvd2Vk IHdoYXQgcmVxdWVzdHMKIwoKIyB5b3UgcHJvYmFibHkgZG9uJ3Qgd2FudCBwZW9w bGUgY29ubmVjdGluZyB0byBsb29wYmFjayBhZGRyZXNzZXMsCiMgd2hvIGtub3dz IHdoYXQgY291bGQgaGFwcGVuIHRoZW4uCiNibG9jayB7CiMJZnJvbTogMC4wLjAu MC8wIHRvOiAxMjcuMC4wLjAvOAojCWxvZzogY29ubmVjdCBlcnJvcgojfQoKIyB0 aGUgcGVvcGxlIGF0IHRoZSAxNzIuMTYuMC4wLzEyIGFyZSBiYWQsIG5vIG9uZSBz aG91bGQgdGFsayB0byB0aGVtLgojIGxvZyB0aGUgY29ubmVjdCByZXF1ZXN0IGFu ZCBhbHNvIHByb3ZpZGUgYW4gZXhhbXBsZSBvbiBob3cgdG8KIyBpbnRlcmFjdCB3 aXRoIGxpYndyYXAuCiNibG9jayB7CiMJZnJvbTogMC4wLjAuMC8wIHRvOiAxNzIu MTYuMC4wLzEyCiMJbGlid3JhcDogc3Bhd24gZmluZ2VyIEAlYQojCWxvZzogY29u bmVjdCBlcnJvcgojfQoKIyB1bmxlc3MgeW91IG5lZWQgaXQsIHlvdSBjb3VsZCBi bG9jayBhbnkgYmluZCByZXF1ZXN0cy4KI2Jsb2NrIHsKIwlmcm9tOiAwLjAuMC4w LzAgdG86IDAuMC4wLjAvMAojCWNvbW1hbmQ6IGJpbmQKIwlsb2c6IGNvbm5lY3Qg ZXJyb3IKI30KCiMgb3IgeW91IG1pZ2h0IHdhbnQgdG8gYWxsb3cgaXQsIGZvciBp bnN0YW5jZSAiYWN0aXZlIiBmdHAgdXNlcyBpdC4KIyBOb3RlIHRoYXQgYSAiYmlu ZHJlcGx5IiBjb21tYW5kIG11c3QgYWxzbyBiZSBhbGxvd2VkLCBpdAojIHNob3Vs ZCB1c3VhbGx5IGJ5IGZyb20gIjAuMC4wLjAvMCIsIGkuZSBpZiBhIGNsaWVudCBv ZiB5b3VycwojIGhhcyBwZXJtaXNzaW9uIHRvIGJpbmQsIGl0IHdpbGwgYWxzbyBo YXZlIHBlcm1pc3Npb24gdG8gYWNjZXB0CiMgdGhlIHJlcGx5IGZyb20gYW55d2hl cmUuCiNwYXNzIHsKIwlmcm9tOiAxMC4wLjAuMC84IHRvOiAwLjAuMC4wLzAKIwlj b21tYW5kOiBiaW5kCiMJbG9nOiBjb25uZWN0IGVycm9yCiN9CgojIHNvbWUgY29u bmVjdGlvbnMgZXhwZWN0IHNvbWUgc29ydCBvZiAicmVwbHkiLCB0aGlzIG1pZ2h0 IGJlCiMgdGhlIHJlcGx5IHRvIGEgYmluZCByZXF1ZXN0IG9yIGl0IG1heSBiZSB0 aGUgcmVwbHkgdG8gYQojIHVkcHBhY2tldCwgc2luY2UgdWRwIGlzIHBhY2tldGJh c2VkLgojIE5vdGUgdGhhdCBub3RoaW5nIGlzIGRvbmUgdG8gdmVyaWZ5IHRoYXQg aXQncyBhICJnZW51aW5lIiByZXBseSwKIyB0aGF0IGlzIGluIGdlbmVyYWwgbm90 IHBvc3NpYmxlIGFueXdheS4gIFRoZSBiZWxvdyB3aWxsIGFsbG93CiMgYWxsICJy ZXBsaWVzIiBpbiB0byB5b3VyIGNsaWVudHMgYXQgdGhlIDEwLjAuMC4wLzggbmV0 LgojcGFzcyB7CiMJZnJvbTogMC4wLjAuMC8wIHRvOiAxMC4wLjAuMC84CiMJY29t bWFuZDogYmluZHJlcGx5IHVkcHJlcGx5CiMJbG9nOiBjb25uZWN0IGVycm9yCiN9 CgoKIyBwYXNzIGFueSBodHRwIGNvbm5lY3RzIHRvIHRoZSBleGFtcGxlLmNvbSBk b21haW4gaWYgdGhleQojIGF1dGhlbnRpY2F0ZSB3aXRoIHVzZXJuYW1lLgojIFRo aXMgbWF0Y2hlcyAiZXhhbXBsZS5jb20iIGl0c2VsZiBhbmQgZXZlcnl0aGluZyBl bmRpbmcgaW4gIi5leGFtcGxlLmNvbSIuCiNwYXNzIHsKIwlmcm9tOiAxMC4wLjAu MC84IHRvOiAuZXhhbXBsZS5jb20gcG9ydCA9IGh0dHAKIwlsb2c6IGNvbm5lY3Qg ZXJyb3IKIwltZXRob2Q6IHVzZXJuYW1lCiN9CgoKCgojIGJsb2NrIGFueSBvdGhl ciBodHRwIGNvbm5lY3RzIHRvIHRoZSBleGFtcGxlLmNvbSBkb21haW4uCiNibG9j ayB7CiMJZnJvbTogMC4wLjAuMC8wIHRvOiAuZXhhbXBsZS5jb20gcG9ydCA9IGh0 dHAKIwlsb2c6IGNvbm5lY3QgZXJyb3IKI30KCiMgZXZlcnlvbmUgZnJvbSBvdXIg aW50ZXJuYWwgbmV0d29yaywgMTAuMC4wLjAvOCBpcyBhbGxvd2VkIHRvIHVzZQoj IHRjcCBhbmQgdWRwIGZvciBldmVyeXRoaW5nIGVsc2UuCiNwYXNzIHsKIwlmcm9t OiAxMC4wLjAuMC84IHRvOiAwLjAuMC4wLzAKIwlwcm90b2NvbDogdGNwIHVkcAoj fQoKIyBsYXN0IGxpbmUsIGJsb2NrIGV2ZXJ5b25lIGVsc2UuICBUaGlzIGlzIHRo ZSBkZWZhdWx0IGJ1dCBpZiB5b3UgcHJvdmlkZQojIG9uZSAgeW91cnNlbGYgeW91 IGNhbiBzcGVjaWZ5IHlvdXIgb3duIGxvZ2dpbmcvYWN0aW9ucwojYmxvY2sgewoj CWZyb206IDAuMC4wLjAvMCB0bzogMC4wLjAuMC8wCiMJbG9nOiBjb25uZWN0IGVy cm9yCiN9CgojIHJvdXRlIGFsbCBodHRwIGNvbm5lY3RzIHZpYSBhbiB1cHN0cmVh bSBzb2NrcyBzZXJ2ZXIsIGFrYSAic2VydmVyLWNoYWluaW5nIi4KI3JvdXRlIHsK IyBmcm9tOiAxMC4wLjAuMC84IHRvOiAwLjAuMC4wLzAgcG9ydCA9IGh0dHAgdmlh OiBzb2Nrcy5leGFtcGxlLm5ldCBwb3J0ID0gc29ja3MKI30KAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA bWF0ZXJpYWwvc29ja3MuY29uZgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAADAwMDA2MDAAMDQwNzE1NgAwMDAwMDEyADAwMDAwMDEwMjUzADExMTE1NDQ1 MjcwADAwMTUxNDUAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAB1c3RhcgAwMG1uMTMzNzY2AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAc3RhZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwMTQ2 ADAwMDAwMDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjICRJZDogc29ja3MuY29u Zix2IDEuMjggMjAwMS8xMi8xMiAxMzo1Njo0MiBrYXJscyBFeHAgJAojCiMgQSBz YW1wbGUgc29ja3MuY29uZgoKIyBUaGUgY29uZmlnZmlsZSBpcyBkaXZpZGVkIGlu dG8gdHdvIHBhcnRzOyBmaXJzdCBtaXNjLiBzZXR0aW5ncywKIyB0aGVuIHRoZSBy b3V0ZXMuICBPYmplY3RzIGluICdbXScgYXJlIG9wdGlvbmFsLgojCiMKIyByZWNv bW1lbmRlZCBvcmRlciBpczoKIwlbZGVidWddCiMJW2xvZ291dHB1dF0KIwlbcmVz b2x2ZXByb3RvY29sXQojCiMJcm91dGVzOgojCQlmcm9tIHRvIHZpYQojCQlbY29t bWFuZF0KIwkJW2V4dGVuc2lvbl0KIwkJW3Byb3RvY29sXQojCQlbcHJveHlwcm90 b2NvbF0KCgojZGVidWc6IDEgICAgICAgICAgICMgdW5jb21tZW50IHRvIGVuYWJs ZSBkZWJ1Z2dpbmcKCiNsb2dvdXRwdXQ6IHN0ZG91dCAgIyB1c2VycyB1c3VhbGx5 IGRvbid0IHdhbnQgdG8gYmUgYm90aGVyZWQgd2l0aCB0aGF0LgoKIyBXaGF0IHBy b3RvY29sIHNob3VsZCBiZSB1c2VkIGZvciByZXNvbHZpbmcgaG9zdG5hbWVzPyAg SXQncyBpbXBvcnRhbnQKIyB0byBzZXQgdGhpcyByaWdodC4KI3Jlc29sdmVwcm90 b2NvbDogdWRwICAjIGRlZmF1bHQKI3Jlc29sdmVwcm90b2NvbDogdGNwICAjIHNl dCB0aGlzIGlmIHlvdXIgc29ja3NzZXJ2ZXIgb25seSBzdXBwb3J0cyBzb2Nrc3Y0 LgojcmVzb2x2ZXByb3RvY29sOiBmYWtlICMgc2V0IHRoaXMgaWYgeW91ciBjbGll bnRzIGNhbid0IGFjY2VzcyBuYW1lc2VydmVyLAoJCSAgICAgICAjIG5laXRoZXIg ZGlyZWN0bHkgbm9yIHByb3hpZWQuCgoKCiMKIyB0aGUgcm91dGVzCiMKCiMgc3Bl Y2lmeWluZyByb3V0ZXMgZm9yIGFjY2VwdGluZyByZW1vdGUgY29ubmVjdGlvbnMg KHZpYSBiaW5kKCkpIGlzCiMgZGlmZmljdWx0IHNpbmNlIHdlIGNhbid0IGtub3cg d2hhdCB0aGUgInRvOiIgYWRkcmVzcyBpcwojIHVudGlsIHdlIGFjdHVhbGx5IGdl dCB0aGUgY29ubmVjdGlvbiAgU2luY2Ugd2Ugc3VwcG9ydCBsZXR0aW5nCiMgdGhl IGNsaWVudCBhY2NlcHQgY29ubmVjdGlvbnMgYm90aCB2aWEgdGhlIHByb3h5c2Vy dmVyIGFuZAojICJkaXJlY3RseSIgYXQgdGhlIHNhbWUgdGltZSwgd2UgaGF2ZSB0 d28gb3B0aW9ucyB0aG91Z2g6CiMgYSkgc3BlY2lmeSBhIHJvdXRlIGZvciBiaW5k IChvbmx5KSBmaXJzdCBnb2luZyB2aWEgdGhlIHByb3h5c2VydmVyLgojICAgIFRo aXMgd2lsbCBhbHNvIGhhbmRsZSAiZGlyZWN0IiBjb25uZWN0aW9ucy4KIyBiKSBz cGVjaWZ5IGEgcm91dGUgZm9yIGJpbmQgKG9ubHkpIGZpcnN0IGdvaW5nICJkaXJl Y3QiLgojICAgIFRoaXMgbWVhbnMgY2xpZW50cyB3aWxsIG9ubHkgYmUgYWJsZSB0 byBhY2NlcHQgImRpcmVjdCIKIyAgICBjb25uZWN0aW9ucy4KCiMgd2Ugd2FudCB0 byBhY2NlcHQgcmVtb3RlIGNvbm5lY3Rpb25zIHZpYSB0aGUgcHJveHlzZXJ2ZXIu CiNyb3V0ZSB7CiMJZnJvbTogMC4wLjAuMC8wIHRvOiAwLjAuMC4wLzAgdmlhOiAx MC4xLjEuMSBwb3J0ID0gMTA4MAojCWNvbW1hbmQ6IGJpbmQKI30KCiMgd2UgZG8g bm90IHdhbnQgdG8gYWNjZXB0IHJlbW90ZSBjb25uZWN0aW9ucyB2aWEgdGhlIHBy b3h5c2VydmVyLgojcm91dGUgewojCWZyb206IDAuMC4wLjAvMCB0bzogMC4wLjAu MC8wIHZpYTogZGlyZWN0CiMJY29tbWFuZDogYmluZAojfQoKCiMgaWYgeW91IGRv bid0IHJvdXRlIGFsbCBsb2NhbCBjb25uZWN0aW9ucyB2aWEgZGlyZWN0LCB5b3Ug c2hvdWxkCiMgYXQgbGVhc3Qgcm91dGUgbmFtZXNlcnZlciBjb25uZWN0aW9ucyB2 aWEgZGlyZWN0IGNvbm5lY3Rpb25zIGlmIHlvdQojIGNhbi4gIFRoYXQgY2FuIG1h a2UgZm9yIG11Y2ggYmV0dGVyIHBlcmZvcm1hbmNlLCBkZXBlbmRpbmcgb24KIyB5 b3VyIHNldHVwLiAgTWFrZSBzdXJlIHRoZSBuYW1lc2VydmVyIGxpbmUgaXMgdGhl IGZpcnN0LgojCiMgQXNzdW1pbmcgeW91ciBuYW1lc2VydmVyIHJ1bnMgb24gYWRk cmVzcyAxMC4xLjEuMSwgeW91IGNhbiBkbyBpdCBsaWtlIHRoaXM6CiNyb3V0ZSB7 CiMJZnJvbTogMC4wLjAuMC8wIHRvOiAxMC4xLjEuMS8zMiBwb3J0ID0gZG9tYWlu IHZpYTogZGlyZWN0CiN9CgoKIyBoYXZlIGEgcm91dGUgbWFraW5nIGFsbCBjb25u ZWN0aW9ucyB0byBsb29wYmFjayBhZGRyZXNzZXMgYmUgZGlyZWN0Lgojcm91dGUg ewojCWZyb206IDAuMC4wLjAvMCAgIHRvOiAxMjcuMC4wLjAvOCAgdmlhOiBkaXJl Y3QKIwljb21tYW5kOiBjb25uZWN0IHVkcGFzc29jaWF0ZSAjIGV2ZXJ5dGhpbmcg YnV0IGJpbmQsIGJpbmQgY29uZnVzZXMgdXMuCiN9CgojIE91ciBuZXQgaXMgdGhl IDEwLjAuMC4wLzggbmV0LCBsZXQgY2xpZW50cyBnb2luZyB0byBsb2NhbCBhZGRy ZXNzIGdvCiMgZGlyZWN0LCBub3QgdmlhIHNlcnZlci4KI3JvdXRlIHsKIwlmcm9t OiAwLjAuMC4wLzAgICB0bzogMTAuMC4wLjAvOCAgIHZpYTogZGlyZWN0CiN9Cgoj IGZvciBwb29yIHNvdWxzIHRyYXBwZWQgYmVoaW5kIGEgbXNwcm94eSBzZXJ2ZXIu CiNyb3V0ZSB7CiMJZnJvbTogMC4wLjAuMC8wICAgdG86IDAuMC4wLjAvMCAgIHZp YTogMTAuMS4xLjEgcG9ydCA9IDE3NDUKIwlwcm90b2NvbDogdGNwCQkJICMgc2Vy dmVyIHN1cHBvcnRzIHRjcAojCXByb3h5cHJvdG9jb2w6IG1zcHJveHlfdjIgICAg ICAgICMgc2VydmVyIHJ1bnMgbXNwcm94eV92MgojfQoKIyBjbGllbnRzIGdvaW5n IGFueXdoZXJlIGVsc2UgZ28gdmlhIHNlcnZlciBsaXN0ZW5pbmcgYXQKIyBJUCBh ZGRyZXNzIDEwLjEuMS4xLCBwb3J0IDEwODAuICAgTm90ZSB0aGF0IHVubGVzcyB5 b3UgaGF2ZQojIHNwZWNpZmllZCBhIGRpcmVjdCBjb25uZWN0aW9uIGZvciBETlMs IG9yIHRoZSBzb2Nrc3NlcnZlciBpcyByZXNvbHZhYmxlCiMgd2l0aG91dCBuZXR3 b3JrIHRyYWZmaWMsIHlvdSBjYW4ndCBnaXZlIGEgaG9zdG5hbWUgZm9yIHRoZSBz b2Nrc3NlcnZlciwKIyB5b3UgbXVzdCBnaXZlIGEgSVAgYWRkcmVzcy4gICh0aGUg cmVhc29ucyBmb3IgdGhhdCBhcmUgbG9naWNhbCBlbm91Z2gsCiMgeW91IHdvdWxk IGNyZWF0ZSBhIGxvb3Agb3RoZXJ3aXNlLikKI3JvdXRlIHsKIwlmcm9tOiAwLjAu MC4wLzAgICB0bzogMC4wLjAuMC8wICAgdmlhOiAxMC4xLjEuMSBwb3J0ID0gMTA4 MAojCXByb3RvY29sOiB0Y3AgdWRwICAgICAgICAgICAgICAgICMgc2VydmVyIHN1 cHBvcnRzIHRjcCBhbmQgdWRwLgojCXByb3h5cHJvdG9jb2w6IHNvY2tzX3Y0IHNv Y2tzX3Y1ICMgc2VydmVyIHN1cHBvcnRzIHNvY2tzIHY0IGFuZCB2NS4KIwltZXRo b2Q6IG5vbmUgI3VzZXJuYW1lCQkgIyB3ZSBhcmUgd2lsbGluZyB0byBhdXRoZW50 aWNhdGUgdmlhCiMJCQkJCSAjIG1ldGhvZCAibm9uZSIsIG5vdCAidXNlcm5hbWUi LgojfQoKIyB0aGlzIGlzIGlkZW50aWNhbCB0byB0aGUgYWJvdmUsIGJ1dCBpdCBt YXRjaGVzIGhvc3RuYW1lcyBpbnN0ZWFkLgojIFRoaXMgaXMgaWYgeW91IGhhdmUg Y2xpZW50cyB0aGF0IGFyZSB1bmFibGUgdG8gcmVzb2x2ZSBob3N0bmFtZXMuCiMg SXQgY2FuIGJlIGltcG9ydGFudCB0aGF0IGhvc3RuYW1lIHJvdXRlcyBjb21lIGFm dGVyIGFkZHJlc3Mgcm91dGVzLgojcm91dGUgewojCWZyb206IDAuMC4wLjAvMCAg IHRvOiAuICAgdmlhOiAxMC4xLjEuMSBwb3J0ID0gMTA4MAojCXByb3RvY29sOiB0 Y3AgdWRwICAgICAgICAgICAgICAgICMgc2VydmVyIHN1cHBvcnRzIHRjcCBhbmQg dWRwLgojCXByb3h5cHJvdG9jb2w6IHNvY2tzX3Y0IHNvY2tzX3Y1ICMgc2VydmVy IHN1cHBvcnRzIHNvY2tzIHY0IGFuZCB2NS4KIwltZXRob2Q6IG5vbmUgI3VzZXJu YW1lCQkgIyB3ZSBhcmUgd2lsbGluZyB0byBhdXRoZW50aWNhdGUgdmlhCiMJCQkJ CSAjIG1ldGhvZCAibm9uZSIsIG5vdCAidXNlcm5hbWUiLgojfQoKIyBpZGVudGlj YWwgdG8gYWJvdmUgdHdvIHJvdXRlcywgYnV0IHVzaW5nIGEgaHR0cHByb3h5IGlu c3RlYWQuCiMKCiNyb3V0ZSB7CiMJZnJvbTogMC4wLjAuMC8wICAgdG86IDAuMC4w LjAvMCAgIHZpYTogMTAuMS4xLjEgcG9ydCA9IDMxMjgKIwljb21tYW5kOiBjb25u ZWN0CQkgIyBvbmx5IHRoaW5nIGEgaHR0cHJveHkgc3VwcG9ydHMuCiMJcHJveHlw cm90b2NvbDogaHR0cF92MS4wCiN9Cgojcm91dGUgewojCWZyb206IDAuMC4wLjAv MCAgIHRvOiAuICAgdmlhOiAxMC4xLjEuMSBwb3J0ID0gMzEyOAojCWNvbW1hbmQ6 IGNvbm5lY3QJCSAjIG9ubHkgdGhpbmcgYSBodHRwcm94eSBzdXBwb3J0cy4KIwlw cm94eXByb3RvY29sOiBodHRwX3YxLjAKI30KAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA --Boundary_(ID_neg25AIe/riohtgjnHdu6g)-- From gww@eng.sun.com Wed Dec 3 15:58:04 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mB3Nw3R4018830; Wed, 3 Dec 2008 15:58:03 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mB3Nw0us019521; Wed, 3 Dec 2008 23:58:02 GMT Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KBB00C0BRWPFR00@brm-avmta-1.central.sun.com>; Wed, 03 Dec 2008 16:58:01 -0700 (MST) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KBB00MRJRWOE8C0@brm-avmta-1.central.sun.com>; Wed, 03 Dec 2008 16:58:01 -0700 (MST) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mB3NvvWc022702; Wed, 03 Dec 2008 15:57:57 -0800 (PST) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id mB3NvRjY004770; Wed, 03 Dec 2008 15:57:27 -0800 (PST) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id mB3NvRQv004769; Wed, 03 Dec 2008 15:57:27 -0800 (PST) Date: Wed, 03 Dec 2008 15:57:27 -0800 (PST) From: Gary Winiger Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] To: Mayuresh.Nirhali@sun.com, james.d.carlson@sun.com Cc: James.Gates@sun.com, gww@eng.sun.com, lsarc-ext@sun.com, psarc-ext@sun.com Message-id: <200812032357.mB3NvRQv004769@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 650 > I have updated the man pages and attaching them here for further review. > Also please find updated PSARC material attached with this mail. The > material include the sample configuration files and updated one_pager & > the proposal document. I've unpacked the new spec and man pages and put them in a materials directory. The mail message on its own is unreadable in the case log. > Please review and let me know your comments. > > I still have not received any response from the dante maintainers. I > will start looking into creating a patch that will fix the Solaris > issues with dante, ofcourse with help from some of you. Gary.. From gww@eng.sun.com Wed Dec 3 15:58:04 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mB3Nw3R4018830; Wed, 3 Dec 2008 15:58:03 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mB3Nw0us019521; Wed, 3 Dec 2008 23:58:02 GMT Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KBB00C0BRWPFR00@brm-avmta-1.central.sun.com>; Wed, 03 Dec 2008 16:58:01 -0700 (MST) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KBB00MRJRWOE8C0@brm-avmta-1.central.sun.com>; Wed, 03 Dec 2008 16:58:01 -0700 (MST) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mB3NvvWc022702; Wed, 03 Dec 2008 15:57:57 -0800 (PST) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id mB3NvRjY004770; Wed, 03 Dec 2008 15:57:27 -0800 (PST) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id mB3NvRQv004769; Wed, 03 Dec 2008 15:57:27 -0800 (PST) Date: Wed, 03 Dec 2008 15:57:27 -0800 (PST) From: Gary Winiger Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] To: Mayuresh.Nirhali@sun.com, james.d.carlson@sun.com Cc: James.Gates@sun.com, gww@eng.sun.com, lsarc-ext@sun.com, psarc-ext@sun.com Message-id: <200812032357.mB3NvRQv004769@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 650 > I have updated the man pages and attaching them here for further review. > Also please find updated PSARC material attached with this mail. The > material include the sample configuration files and updated one_pager & > the proposal document. I've unpacked the new spec and man pages and put them in a materials directory. The mail message on its own is unreadable in the case log. > Please review and let me know your comments. > > I still have not received any response from the dante maintainers. I > will start looking into creating a patch that will fix the Solaris > issues with dante, ofcourse with help from some of you. Gary.. From Mayuresh.Nirhali@sun.com Thu Dec 4 21:20:53 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mB55KrH6014874; Thu, 4 Dec 2008 21:20:53 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mB55Kq8S053374; Thu, 4 Dec 2008 22:20:52 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KBE00B0X1IRT600@nwk-avmta-1.sfbay.Sun.COM>; Thu, 04 Dec 2008 21:20:51 -0800 (PST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KBE005191IPKLC0@nwk-avmta-1.sfbay.Sun.COM>; Thu, 04 Dec 2008 21:20:50 -0800 (PST) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mB55Knkr010917; Fri, 05 Dec 2008 05:20:49 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KBE00D011FLPN00@mail-apac.sun.com> (original mail from Mayuresh.Nirhali@Sun.COM); Fri, 05 Dec 2008 13:20:49 +0800 (SGT) Received: from [129.158.227.167] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KBE00MWZ1IOVZWU@mail-apac.sun.com>; Fri, 05 Dec 2008 13:20:49 +0800 (SGT) Date: Fri, 05 Dec 2008 10:50:48 +0530 From: Mayuresh Nirhali Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <200812032357.mB3NvRQv004769@marduk.eng.sun.com> Sender: Mayuresh.Nirhali@sun.com To: Gary Winiger Cc: James.D.Carlson@sun.com, James.Gates@sun.com, lsarc-ext@sun.com, PSARC-ext@sun.com Message-id: <4938BA30.7020607@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200812032357.mB3NvRQv004769@marduk.eng.sun.com> User-Agent: Thunderbird 2.0.0.16 (X11/20080908) Status: RO Content-Length: 1693 Hello, The dante community responded to my request. The good news is that they are planning the next release in January 2009 and the beta of which will come out later this month. I have forwarded all the PAM related concerns to them and they have shown interest in getting them fixed in their upcoming release. I have also discussed the concern regarding dante not following the recommended practice of privileges in Solaris. The community feels that they do not have enough time to get this done for this release and if we can get a patch that would resolve those concerns, they are happy to review. I think it is wise to work with them and try to resolve all our concerns in their next release and have that integrated in OpenSolaris. comments ? I am expecting changes to the proposal that would depend on how we implement privileges in dante, so I believe it is still some more time before we can move ahead with this case. Thanks for your support! Mayuresh Gary Winiger wrote: >> I have updated the man pages and attaching them here for further review. >> Also please find updated PSARC material attached with this mail. The >> material include the sample configuration files and updated one_pager & >> the proposal document. >> > > I've unpacked the new spec and man pages and put them in a > materials directory. The mail message on its own is unreadable > in the case log. > > >> Please review and let me know your comments. >> >> I still have not received any response from the dante maintainers. I >> will start looking into creating a patch that will fix the Solaris >> issues with dante, ofcourse with help from some of you. >> > > Gary.. > From Mayuresh.Nirhali@sun.com Thu Dec 4 21:20:53 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mB55KrH6014874; Thu, 4 Dec 2008 21:20:53 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mB55Kq8S053374; Thu, 4 Dec 2008 22:20:52 -0700 (MST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KBE00B0X1IRT600@nwk-avmta-1.sfbay.Sun.COM>; Thu, 04 Dec 2008 21:20:51 -0800 (PST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KBE005191IPKLC0@nwk-avmta-1.sfbay.Sun.COM>; Thu, 04 Dec 2008 21:20:50 -0800 (PST) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mB55Knkr010917; Fri, 05 Dec 2008 05:20:49 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KBE00D011FLPN00@mail-apac.sun.com> (original mail from Mayuresh.Nirhali@Sun.COM); Fri, 05 Dec 2008 13:20:49 +0800 (SGT) Received: from [129.158.227.167] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KBE00MWZ1IOVZWU@mail-apac.sun.com>; Fri, 05 Dec 2008 13:20:49 +0800 (SGT) Date: Fri, 05 Dec 2008 10:50:48 +0530 From: Mayuresh Nirhali Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <200812032357.mB3NvRQv004769@marduk.eng.sun.com> Sender: Mayuresh.Nirhali@sun.com To: Gary Winiger Cc: James.D.Carlson@sun.com, James.Gates@sun.com, lsarc-ext@sun.com, PSARC-ext@sun.com Message-id: <4938BA30.7020607@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200812032357.mB3NvRQv004769@marduk.eng.sun.com> User-Agent: Thunderbird 2.0.0.16 (X11/20080908) Status: RO Content-Length: 1693 Hello, The dante community responded to my request. The good news is that they are planning the next release in January 2009 and the beta of which will come out later this month. I have forwarded all the PAM related concerns to them and they have shown interest in getting them fixed in their upcoming release. I have also discussed the concern regarding dante not following the recommended practice of privileges in Solaris. The community feels that they do not have enough time to get this done for this release and if we can get a patch that would resolve those concerns, they are happy to review. I think it is wise to work with them and try to resolve all our concerns in their next release and have that integrated in OpenSolaris. comments ? I am expecting changes to the proposal that would depend on how we implement privileges in dante, so I believe it is still some more time before we can move ahead with this case. Thanks for your support! Mayuresh Gary Winiger wrote: >> I have updated the man pages and attaching them here for further review. >> Also please find updated PSARC material attached with this mail. The >> material include the sample configuration files and updated one_pager & >> the proposal document. >> > > I've unpacked the new spec and man pages and put them in a > materials directory. The mail message on its own is unreadable > in the case log. > > >> Please review and let me know your comments. >> >> I still have not received any response from the dante maintainers. I >> will start looking into creating a patch that will fix the Solaris >> issues with dante, ofcourse with help from some of you. >> > > Gary.. > From carlsonj@phorcys.east.sun.com Wed Dec 10 07:20:59 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mBAFKxIX024947; Wed, 10 Dec 2008 07:20:59 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mBAFKps7021096; Wed, 10 Dec 2008 08:20:56 -0700 (MST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KBO0002W2MVH500@brm-avmta-1.central.sun.com>; Wed, 10 Dec 2008 08:20:55 -0700 (MST) Received: from phorcys.east.sun.com ([129.148.174.143]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KBO00F3L2MU7Z70@brm-avmta-1.central.sun.com>; Wed, 10 Dec 2008 08:20:54 -0700 (MST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mBAFKrFE014364; Wed, 10 Dec 2008 10:20:53 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mBAFKriH014361; Wed, 10 Dec 2008 10:20:53 -0500 (EST) Date: Wed, 10 Dec 2008 10:20:53 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <4938BA30.7020607@Sun.COM> To: Mayuresh Nirhali Cc: Gary Winiger , James.Gates@sun.com, lsarc-ext@sun.com, PSARC-ext@sun.com Message-id: <18751.56917.99708.987763@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200812032357.mB3NvRQv004769@marduk.eng.sun.com> <4938BA30.7020607@Sun.COM> Status: RO Content-Length: 602 Mayuresh Nirhali writes: > I am expecting changes to the proposal that would depend on how we > implement privileges in dante, so I believe it is still some more time > before we can move ahead with this case. This all sounds good to me, so +1. Not specifically an architectural issue, but the sockd(1M) man page should explain how to turn the service on and off using SMF. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From carlsonj@phorcys.east.sun.com Wed Dec 10 07:20:59 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mBAFKxIX024947; Wed, 10 Dec 2008 07:20:59 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mBAFKps7021096; Wed, 10 Dec 2008 08:20:56 -0700 (MST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KBO0002W2MVH500@brm-avmta-1.central.sun.com>; Wed, 10 Dec 2008 08:20:55 -0700 (MST) Received: from phorcys.east.sun.com ([129.148.174.143]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KBO00F3L2MU7Z70@brm-avmta-1.central.sun.com>; Wed, 10 Dec 2008 08:20:54 -0700 (MST) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mBAFKrFE014364; Wed, 10 Dec 2008 10:20:53 -0500 (EST) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id mBAFKriH014361; Wed, 10 Dec 2008 10:20:53 -0500 (EST) Date: Wed, 10 Dec 2008 10:20:53 -0500 From: James Carlson Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] In-reply-to: <4938BA30.7020607@Sun.COM> To: Mayuresh Nirhali Cc: Gary Winiger , James.Gates@sun.com, lsarc-ext@sun.com, PSARC-ext@sun.com Message-id: <18751.56917.99708.987763@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200812032357.mB3NvRQv004769@marduk.eng.sun.com> <4938BA30.7020607@Sun.COM> Status: RO Content-Length: 602 Mayuresh Nirhali writes: > I am expecting changes to the proposal that would depend on how we > implement privileges in dante, so I believe it is still some more time > before we can move ahead with this case. This all sounds good to me, so +1. Not specifically an architectural issue, but the sockd(1M) man page should explain how to turn the service on and off using SMF. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From gww@eng.sun.com Wed Dec 10 08:02:51 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mBAG2ofK019206; Wed, 10 Dec 2008 08:02:50 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mBAG2laF026542; Wed, 10 Dec 2008 08:02:50 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KBO00E0T4KQOU00@nwk-avmta-2.sfbay.sun.com>; Wed, 10 Dec 2008 08:02:50 -0800 (PST) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KBO00DJY4KODT20@nwk-avmta-2.sfbay.sun.com>; Wed, 10 Dec 2008 08:02:48 -0800 (PST) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mBAG2jS5046566; Wed, 10 Dec 2008 08:02:45 -0800 (PST) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id mBAG26Fp003808; Wed, 10 Dec 2008 08:02:06 -0800 (PST) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id mBAG26gT003807; Wed, 10 Dec 2008 08:02:06 -0800 (PST) Date: Wed, 10 Dec 2008 08:02:06 -0800 (PST) From: Gary Winiger Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] To: Mayuresh.Nirhali@sun.com, James.D.Carlson@sun.com Cc: gww@eng.sun.com, James.Gates@sun.com, lsarc-ext@sun.com, PSARC-ext@sun.com Message-id: <200812101602.mBAG26gT003807@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 1027 > This all sounds good to me, so +1. I got to it as well last night. It's at the NIT level. +1. > Not specifically an architectural issue, but the sockd(1M) man page > should explain how to turn the service on and off using SMF. My nits -- a little more detailed than Jim's 1. This project should meet the SFM policy by providing and documenting action and value authorizations and documenting the FMRI in sockd(1m). (See me off line and we can work out the nit). 2. sockd.conf(4) user.privileged and user.unprivileged sample seems to imply a "sockd" user. I don't believe this project introduces a sockd user. Perhaps the sample should show user.privileged:root and user.unprivileged:daemon or noaccess. 3. Depending on whether roles can uses sockd or not, there probably should be a sample account type pam stack shown. You're already working with Joep on PAM. Take this into consideration. Y'all can feel free to contact me on PAM issues as well. Gary.. From gww@eng.sun.com Wed Dec 10 08:02:51 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mBAG2ofK019206; Wed, 10 Dec 2008 08:02:50 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mBAG2laF026542; Wed, 10 Dec 2008 08:02:50 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KBO00E0T4KQOU00@nwk-avmta-2.sfbay.sun.com>; Wed, 10 Dec 2008 08:02:50 -0800 (PST) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KBO00DJY4KODT20@nwk-avmta-2.sfbay.sun.com>; Wed, 10 Dec 2008 08:02:48 -0800 (PST) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mBAG2jS5046566; Wed, 10 Dec 2008 08:02:45 -0800 (PST) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id mBAG26Fp003808; Wed, 10 Dec 2008 08:02:06 -0800 (PST) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id mBAG26gT003807; Wed, 10 Dec 2008 08:02:06 -0800 (PST) Date: Wed, 10 Dec 2008 08:02:06 -0800 (PST) From: Gary Winiger Subject: Re: Dante: A Socks server and client implementation [PSARC/2008/714 timeout 11/25/2008] To: Mayuresh.Nirhali@sun.com, James.D.Carlson@sun.com Cc: gww@eng.sun.com, James.Gates@sun.com, lsarc-ext@sun.com, PSARC-ext@sun.com Message-id: <200812101602.mBAG26gT003807@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 1027 > This all sounds good to me, so +1. I got to it as well last night. It's at the NIT level. +1. > Not specifically an architectural issue, but the sockd(1M) man page > should explain how to turn the service on and off using SMF. My nits -- a little more detailed than Jim's 1. This project should meet the SFM policy by providing and documenting action and value authorizations and documenting the FMRI in sockd(1m). (See me off line and we can work out the nit). 2. sockd.conf(4) user.privileged and user.unprivileged sample seems to imply a "sockd" user. I don't believe this project introduces a sockd user. Perhaps the sample should show user.privileged:root and user.unprivileged:daemon or noaccess. 3. Depending on whether roles can uses sockd or not, there probably should be a sample account type pam stack shown. You're already working with Joep on PAM. Take this into consideration. Y'all can feel free to contact me on PAM issues as well. Gary..