From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f44.google.com (mail-oo1-f44.google.com [209.85.161.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7992F6EB6B for ; Thu, 14 Mar 2024 11:52:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710417172; cv=none; b=dvGcGzy1JSypNzZ17ZD83WzlFMi0Sn2UVE3OP4jpodYFk6gtCgcwBzrJOgWuxl+26mXy+speQ4tOw38zw8Tk/E4AerY+RhyotI4JQjSrquN9GgZS8E2PE214fEV6eK3VZYxAnY0o4ZdieCwqYg8VeAJ6zaslAc8AYUoQo3EmXiE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1710417172; c=relaxed/simple; bh=DR7uIQcQtirFNtRaxp4uGyTaLvC4VFi+/92L9+pR+Yw=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=XEDkh/vh7QRAlV6LPfajGm1bLOLwnnEfh1fJ+EiRE8Ltdtk25wEx4Us3J0CGsHxm5kO2A/k9sQTywIC638pFM2byoFBvljLJ/bOcSyH54HQmcU/VsoySJULlM733oLK2TB/XOj6D7ghJCO1IrgmjohFBtrzrd8nHU8zX+Gvfw1A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=PxEBlzBS; arc=none smtp.client-ip=209.85.161.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="PxEBlzBS" Received: by mail-oo1-f44.google.com with SMTP id 006d021491bc7-5a4336ce1dbso378070eaf.0 for ; Thu, 14 Mar 2024 04:52:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1710417169; x=1711021969; darn=lists.linux.dev; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=Tdifjv40tbAIgozYYTGFKCKIMm7LnNYUe3NS1/d4TCc=; b=PxEBlzBS2qjgaKBhbqlbUGN78WwYHwr8sm/iDVvMTBYHihyxlYF5uix9mtBdhBJekh eh40IbsPeodFH5jXoi0SrVTDdVUStuagGvI5xqgchniuhzv9POEp0GgTEjayh+gHwuuK HrrRR9M72P95TkSU1qBCT2geC8xW40HXg1MNOQGxLWLHb12txSUwsa/v828QZOZUCbP+ Eg8CTAtuPuJMDwqxI3hI1n1LpcyRwj5iaOIFS74zbSNopTOw00mieEkolUNss71V0pMX J6myyt76nYPl5IksggN19ptn46D3UIO+VJTiZqR3nGiWELCNBt2XYugaLZKE2dn6B5MH Z9Lw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710417169; x=1711021969; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=Tdifjv40tbAIgozYYTGFKCKIMm7LnNYUe3NS1/d4TCc=; b=dIWZFLFehN5ygKJ1jRwu8QSCf80AZtGDsFQo7ZVE6f2MwKGA0aK0UKndFJNr3OdRUY M13zLj8HUTlmu3nAoT8LLN62ItMIKqQAWjKosktpXYF1Gsco7coIdVV1HhDqg8oscsXn /qlzevI7xjKmOUhdpx6JQUsynD9UywN6l8tBpSaOICWgtszP4VhQd6ZTIWtSJQQuUSGJ aLLZYsk8UOLr+9oOVuhA7X349piGuKWnc4Bu9tvo9z29vyg2ibbD3NwoD4a5l8izgs8t MuQJ/P9R/80rPMOSh0kIzJdkooXoBTU6s0qu+5KLB9n8C6hNqu5RqbRuLu9hnNd7FpPu cwsQ== X-Forwarded-Encrypted: i=1; AJvYcCXu49Biehmxv/CxAolzQQOKUzd2Fvf2P3FNnRotGISDMpnZxda+2OCqtF55SZr+agNbcaqm5YEv5RY4ijBVDipKh1As X-Gm-Message-State: AOJu0Yyzvkvw4WQglJtgEBlbwQW2jIzNkV6lCpMLFrqgRi1qOLoEdgwc jJzQoj8ZT01XPfCxhe5kW8V1rFgUfSgeeV1TnpJLHtZWyIZ+Ir5c X-Google-Smtp-Source: AGHT+IHPtvNpbzsaayWywW7W8tum6qeCMeXLFKZPuvZvQSEuflx/ONggDCEzNvvaKOcLF8ZD/bugFA== X-Received: by 2002:a05:6358:6590:b0:17b:b52c:c121 with SMTP id x16-20020a056358659000b0017bb52cc121mr1728763rwh.13.1710417169288; Thu, 14 Mar 2024 04:52:49 -0700 (PDT) Received: from [192.168.254.38] ([50.39.172.77]) by smtp.gmail.com with ESMTPSA id 192-20020a6301c9000000b005d7994a08dcsm522636pgb.36.2024.03.14.04.52.48 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 14 Mar 2024 04:52:48 -0700 (PDT) Message-ID: Date: Thu, 14 Mar 2024 04:52:47 -0700 Precedence: bulk X-Mailing-List: iwd@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [REGRESSION] Re: [PATCH] crypto: pkcs7: remove sha1 support Content-Language: en-US To: Eric Biggers , Jeff Johnson Cc: Johannes Berg , Karel Balej , dimitri.ledkov@canonical.com, alexandre.torgue@foss.st.com, davem@davemloft.net, dhowells@redhat.com, herbert@gondor.apana.org.au, keyrings@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, linux-modules@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, mcgrof@kernel.org, mcoquelin.stm32@gmail.com, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, iwd@lists.linux.dev References: <005f998ec59e27633b1b99fdf929e40ccfd401c1.camel@sipsolutions.net> <20240313194423.GA1111@sol.localdomain> <20240313202223.GB1111@sol.localdomain> <20240313221043.GC1111@sol.localdomain> <20240313230611.GD1111@sol.localdomain> From: James Prestwood In-Reply-To: <20240313230611.GD1111@sol.localdomain> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Hi, On 3/13/24 4:06 PM, Eric Biggers wrote: > On Wed, Mar 13, 2024 at 03:51:10PM -0700, Jeff Johnson wrote: >> On 3/13/2024 3:10 PM, Eric Biggers wrote: >>> On Wed, Mar 13, 2024 at 02:17:29PM -0700, James Prestwood wrote: >>>> Hi, >>>> >>>> On 3/13/24 1:22 PM, Eric Biggers wrote: >>>>> On Wed, Mar 13, 2024 at 01:12:54PM -0700, James Prestwood wrote: >>>>>> Hi, >>>>>> >>>>>> On 3/13/24 12:44 PM, Eric Biggers wrote: >>>>>>> On Wed, Mar 13, 2024 at 10:26:06AM -0700, James Prestwood wrote: >>>>>>>> Hi, >>>>>>>> >>>>>>>> On 3/13/24 1:56 AM, Johannes Berg wrote: >>>>>>>>> Not sure why you're CC'ing the world, but I guess adding a few more >>>>>>>>> doesn't hurt ... >>>>>>>>> >>>>>>>>> On Wed, 2024-03-13 at 09:50 +0100, Karel Balej wrote: >>>>>>>>>> and I use iwd >>>>>>>>> This is your problem, the wireless stack in the kernel doesn't use any >>>>>>>>> kernel crypto code for 802.1X. >>>>>>>> Yes, the wireless stack has zero bearing on the issue. I think that's what >>>>>>>> you meant by "problem". >>>>>>>> >>>>>>>> IWD has used the kernel crypto API forever which was abruptly broken, that >>>>>>>> is the problem. >>>>>>>> >>>>>>>> The original commit says it was to remove support for sha1 signed kernel >>>>>>>> modules, but it did more than that and broke the keyctl API. >>>>>>>> >>>>>>> Which specific API is iwd using that is relevant here? >>>>>>> I cloned https://kernel.googlesource.com/pub/scm/network/wireless/iwd >>>>>>> and grepped for keyctl and AF_ALG, but there are no matches. >>>>>> IWD uses ELL for its crypto, which uses the AF_ALG API: >>>>>> >>>>>> https://git.kernel.org/pub/scm/libs/ell/ell.git/ >>>>> Thanks for pointing out that the relevant code is really in that separate >>>>> repository. Note, it seems that keyctl() is the problem here, not AF_ALG. The >>>>> blamed commit didn't change anything for AF_ALG. >>>>> >>>>>> I believe the failure is when calling: >>>>>> >>>>>> KEYCTL_PKEY_QUERY enc="x962" hash="sha1" >>>>>> >>>>>> From logs Michael posted on the IWD list, the ELL API that fails is: >>>>>> >>>>>> l_key_get_info (ell.git/ell/key.c:416) >>>>> Okay, I guess that's what's actually causing the problem. KEYCTL_PKEY_* are a >>>>> weird set of APIs where userspace can ask the kernel to do asymmetric key >>>>> operations. It's unclear why they exist, as the same functionality is available >>>>> in userspace crypto libraries. >>>>> >>>>> I suppose that the blamed commit, or at least part of it, will need to be >>>>> reverted to keep these weird keyctls working. >>>>> >>>>> For the future, why doesn't iwd just use a userspace crypto library such as >>>>> OpenSSL? >>>> I was not around when the original decision was made, but a few reasons I >>>> know we don't use openSSL: >>>> >>>>  - IWD has virtually zero dependencies. >>> Depending on something in the kernel does not eliminate a dependency; it just >>> adds that particular kernel UAPI to your list of dependencies. The reason that >>> we're having this discussion in the first place is because iwd is depending on >>> an obscure kernel UAPI that is not well defined. Historically it's been hard to >>> avoid "breaking" changes in these crypto-related UAPIs because of the poor >>> design where a huge number of algorithms are potentially supported, but the list >>> is undocumented and it varies from one system to another based on configuration. >>> Also due to their obscurity many kernel developers don't know that these UAPIs >>> even exist. (The reaction when someone finds out is usually "Why!?") >>> >>> It may be worth looking at if iwd should make a different choice for this >>> dependency. It's understandable to blame dependencies when things go wrong, but >>> at the same time the choice of dependency is very much a choice, and some >>> choices can be more technically sound and cause fewer problems than others... >>> >>>>  - OpenSSL + friends are rather large libraries. >>> The Linux kernel is also large, and it's made larger by having to support >>> obsolete crypto algorithms for backwards compatibility with iwd. >>> >>>>  - AF_ALG has transparent hardware acceleration (not sure if openSSL does >>>> too). >>> OpenSSL takes advantage of CPU-based hardware acceleration, e.g. AES-NI. >>> >>>> Another consideration is once you support openSSL someone wants wolfSSL, >>>> then boringSSL etc. Even if users implement support it just becomes a huge >>>> burden to carry for the project. Just look at wpa_supplicant's src/crypto/ >>>> folder, nearly 40k LOC in there, compared to ELL's crypto modules which is >>>> ~5k. You have to sort out all the nitty gritty details of each library, and >>>> provide a common driver/API for the core code, differences between openssl >>>> versions, the list goes on. >>> What is the specific functionality that you're actually relying on that you >>> think would need 40K lines of code to replace, even using OpenSSL? I see you >>> are using KEYCTL_PKEY_*, but what specifically are you using them for? What >>> operations are being performed, and with which algorithms and key formats? >>> Also, is the kernel behavior that you're relying on documented anywhere? There >>> are man pages for those keyctls, but they don't say anything about any >>> particular hash algorithm, SHA-1 or otherwise, being supported. >> >> "And we simply do not break user space." >> -Linus Torvalds >> >> Is this no longer applicable? >> > As I said, the commit, or at least the part of it that broke iwd (it's not clear > that it's the whole commit), needs to be reverted. > > I just hope that, simultaneously, the iwd developers will consider improving the > design of iwd to avoid this type of recurring issue in the future. After all, > this may be the only real chance for such a discussion before the next time iwd > breaks. > > Also, part of the reason I'm asking about what functionality that iwd is relying > on is so that, if necessary, it can be properly documented and supported... > > If we don't know what we are supporting, it is very hard to support it. IWD uses AF_ALG/keyctl for _all_ its crypto, cipher, and checksum needs. Anything that wifi requires as far as crypto goes IWD uses the kernel, except ECC is the only exception. The entire list of crypto requirements (for full support at least) for IWD is here: https://git.kernel.org/pub/scm/network/wireless/iwd.git/tree/tools/test_runner_kernel_config For KEYCTL_PKEY_* specifically we use it for all asymmetric crypto operations, (query), encrypt, decrypt, sign, verify. I'll be honest, the AF_ALG/keyctl support in ELL was mostly done by the time I started working on IWD so I was not aware the documentation was so poor. That is an entirely separate issue than this IMO, and I'm happy to help with getting docs updated to include a proper list of supported features. In addition maybe some automated testing that gets run on kernel builds which actually exercises this API so it doesn't get accidentally get broken in the future? Docs/tests IMO are the proper "fix" here, not telling someone to stop using an API that has existed a long time. I'm also not entirely sure why this stuff continues to be removed from the kernel. First MD4, then it got reverted, then this (now reverted, thanks). Both cases there was not clear justification of why it was being removed. Thanks, James > > - Eric > From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 6ABB9C54E67 for ; Thu, 14 Mar 2024 11:53:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Content-Type: Content-Transfer-Encoding:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:From:References:Cc:To:Subject: MIME-Version:Date:Message-ID:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=N7QniEKUSCc5mLepUYtBb4yytEjaz52tnzNzsRyUbdw=; b=ZTo3GQadhVCyYx lD6hE/Be4RTp1tf+Jm1E8ygBkoN/R9cJop8nGqNPvYm6Ys4bprDfDZoc2LC9K8ifZkDhEuhW9Cxm5 FRH+gZ8oL12xO+6bkG7XkhHV7UFLnYD9MPf8F7zqDCSEy2AmNJ/cyRnbfnljzwmif1g0timqb56qZ SwoFsh+luHiJ5MLD4nc7wIBKrs+H58+SLVkXJDSJBfqFplgUShNgo9eE0PcX1jV+H0oVwvfqmIXex GI8hwNHVMbU9c6liSwNQM2N8owtR0OjHTIUJEFABUMksZlnW8H8PHuHhUSdVwCA2t4jvS8xQbS+1H j/1IerenH4QF/KYmOufA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rkjdn-0000000E8Tn-1sHo; Thu, 14 Mar 2024 11:52:55 +0000 Received: from mail-oo1-xc2c.google.com ([2607:f8b0:4864:20::c2c]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rkjdj-0000000E8Sh-41gh for linux-arm-kernel@lists.infradead.org; Thu, 14 Mar 2024 11:52:53 +0000 Received: by mail-oo1-xc2c.google.com with SMTP id 006d021491bc7-5a4336ce1dbso378078eaf.0 for ; Thu, 14 Mar 2024 04:52:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1710417170; x=1711021970; darn=lists.infradead.org; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=Tdifjv40tbAIgozYYTGFKCKIMm7LnNYUe3NS1/d4TCc=; b=gTUTDqaED22h36lNiM61lGwhVGtjNnNwRRFU3KOmsHhQrUNyBt3yUkKY5Kqxsf61YQ gJm5FgyueywV5/A15VcKpzJ9f28oDlpbqHvzcxD3uOUY8pLjopPqTndWi11Ew+Vyew2o A1mSbed87AUA2natmyR1o/vQuEXtf6XlYGvDCOzPaEaUJ6ldjGQL1oKS4hIX7ZGq3ig0 YwgAndW1fNnqUhrw26AvgmVKTbAcGXROveoyVc1W8WZcvEnNL39RaS2vvVaJ+I0y/0Dw LlsXfSHXT7KKolAxISDr9XW+EN1hgt6xu8S/8mnpB+nX5OhoU9LFJdnmCfM4SJobITnO UvjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710417170; x=1711021970; h=content-transfer-encoding:in-reply-to:from:references:cc:to :content-language:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=Tdifjv40tbAIgozYYTGFKCKIMm7LnNYUe3NS1/d4TCc=; b=QUVvZAR6tA+yQ9vJtGwkIv6JyvxjHQJdHoYr6UR20c2lrDmmT85MkGSnGQ20XhMfL2 FkZkV6PDnZA4hWMEuY93tO9POMkxo8Q7a0nhNKE2s7NWIHVAvG8F5kbe+BOpE5kzjs2x CIAYaEeO3Rf2eVgbXlv0TMGPX8MG2eVfN697pWJ+tnnN5EG3Wog6WWjAKvIUigCtSVgn bO3mmroRstW6MIarHGf3LbxIk6egao9FBLXonRJ9Sd3qRV5lWbY9i5S8b2iX1yxrUQhR BQWEzdkxzApGZPmDUAKNtLtFqEWJUk5LGaZVVE24hE6Gk6T4ypN4QUPcwWeBOQ2RcFnL TePQ== X-Forwarded-Encrypted: i=1; AJvYcCXZBb4/5ROz+tdOd8Ie6zM4TFNe4rFoIHBG0VnNG/HaFC/qUuC46C7wEJiSAvULdJg8rC9KvT9t4p7MXK1Txp5XIS8XCMIvXNKjG7U6funeNnsxmys= X-Gm-Message-State: AOJu0Yz0MVJuQvNryFpWE/bZRCkhZ3wX905Qz25LTK+ARnxzA39OKZUA U88zfyQedePa9MQIFQKcRUlc2GfF+D7FpxG9CXzt6UaIB35XvHR6 X-Google-Smtp-Source: AGHT+IHPtvNpbzsaayWywW7W8tum6qeCMeXLFKZPuvZvQSEuflx/ONggDCEzNvvaKOcLF8ZD/bugFA== X-Received: by 2002:a05:6358:6590:b0:17b:b52c:c121 with SMTP id x16-20020a056358659000b0017bb52cc121mr1728763rwh.13.1710417169288; Thu, 14 Mar 2024 04:52:49 -0700 (PDT) Received: from [192.168.254.38] ([50.39.172.77]) by smtp.gmail.com with ESMTPSA id 192-20020a6301c9000000b005d7994a08dcsm522636pgb.36.2024.03.14.04.52.48 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 14 Mar 2024 04:52:48 -0700 (PDT) Message-ID: Date: Thu, 14 Mar 2024 04:52:47 -0700 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [REGRESSION] Re: [PATCH] crypto: pkcs7: remove sha1 support Content-Language: en-US To: Eric Biggers , Jeff Johnson Cc: Johannes Berg , Karel Balej , dimitri.ledkov@canonical.com, alexandre.torgue@foss.st.com, davem@davemloft.net, dhowells@redhat.com, herbert@gondor.apana.org.au, keyrings@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, linux-modules@vger.kernel.org, linux-stm32@st-md-mailman.stormreply.com, mcgrof@kernel.org, mcoquelin.stm32@gmail.com, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, iwd@lists.linux.dev References: <005f998ec59e27633b1b99fdf929e40ccfd401c1.camel@sipsolutions.net> <20240313194423.GA1111@sol.localdomain> <20240313202223.GB1111@sol.localdomain> <20240313221043.GC1111@sol.localdomain> <20240313230611.GD1111@sol.localdomain> From: James Prestwood In-Reply-To: <20240313230611.GD1111@sol.localdomain> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240314_045252_055755_CB62FB27 X-CRM114-Status: GOOD ( 43.32 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org SGksCgpPbiAzLzEzLzI0IDQ6MDYgUE0sIEVyaWMgQmlnZ2VycyB3cm90ZToKPiBPbiBXZWQsIE1h ciAxMywgMjAyNCBhdCAwMzo1MToxMFBNIC0wNzAwLCBKZWZmIEpvaG5zb24gd3JvdGU6Cj4+IE9u IDMvMTMvMjAyNCAzOjEwIFBNLCBFcmljIEJpZ2dlcnMgd3JvdGU6Cj4+PiBPbiBXZWQsIE1hciAx MywgMjAyNCBhdCAwMjoxNzoyOVBNIC0wNzAwLCBKYW1lcyBQcmVzdHdvb2Qgd3JvdGU6Cj4+Pj4g SGksCj4+Pj4KPj4+PiBPbiAzLzEzLzI0IDE6MjIgUE0sIEVyaWMgQmlnZ2VycyB3cm90ZToKPj4+ Pj4gT24gV2VkLCBNYXIgMTMsIDIwMjQgYXQgMDE6MTI6NTRQTSAtMDcwMCwgSmFtZXMgUHJlc3R3 b29kIHdyb3RlOgo+Pj4+Pj4gSGksCj4+Pj4+Pgo+Pj4+Pj4gT24gMy8xMy8yNCAxMjo0NCBQTSwg RXJpYyBCaWdnZXJzIHdyb3RlOgo+Pj4+Pj4+IE9uIFdlZCwgTWFyIDEzLCAyMDI0IGF0IDEwOjI2 OjA2QU0gLTA3MDAsIEphbWVzIFByZXN0d29vZCB3cm90ZToKPj4+Pj4+Pj4gSGksCj4+Pj4+Pj4+ Cj4+Pj4+Pj4+IE9uIDMvMTMvMjQgMTo1NiBBTSwgSm9oYW5uZXMgQmVyZyB3cm90ZToKPj4+Pj4+ Pj4+IE5vdCBzdXJlIHdoeSB5b3UncmUgQ0MnaW5nIHRoZSB3b3JsZCwgYnV0IEkgZ3Vlc3MgYWRk aW5nIGEgZmV3IG1vcmUKPj4+Pj4+Pj4+IGRvZXNuJ3QgaHVydCAuLi4KPj4+Pj4+Pj4+Cj4+Pj4+ Pj4+PiBPbiBXZWQsIDIwMjQtMDMtMTMgYXQgMDk6NTAgKzAxMDAsIEthcmVsIEJhbGVqIHdyb3Rl Ogo+Pj4+Pj4+Pj4+ICAgICAgYW5kIEkgdXNlIGl3ZAo+Pj4+Pj4+Pj4gVGhpcyBpcyB5b3VyIHBy b2JsZW0sIHRoZSB3aXJlbGVzcyBzdGFjayBpbiB0aGUga2VybmVsIGRvZXNuJ3QgdXNlIGFueQo+ Pj4+Pj4+Pj4ga2VybmVsIGNyeXB0byBjb2RlIGZvciA4MDIuMVguCj4+Pj4+Pj4+IFllcywgdGhl IHdpcmVsZXNzIHN0YWNrIGhhcyB6ZXJvIGJlYXJpbmcgb24gdGhlIGlzc3VlLiBJIHRoaW5rIHRo YXQncyB3aGF0Cj4+Pj4+Pj4+IHlvdSBtZWFudCBieSAicHJvYmxlbSIuCj4+Pj4+Pj4+Cj4+Pj4+ Pj4+IElXRCBoYXMgdXNlZCB0aGUga2VybmVsIGNyeXB0byBBUEkgZm9yZXZlciB3aGljaCB3YXMg YWJydXB0bHkgYnJva2VuLCB0aGF0Cj4+Pj4+Pj4+IGlzIHRoZSBwcm9ibGVtLgo+Pj4+Pj4+Pgo+ Pj4+Pj4+PiBUaGUgb3JpZ2luYWwgY29tbWl0IHNheXMgaXQgd2FzIHRvIHJlbW92ZSBzdXBwb3J0 IGZvciBzaGExIHNpZ25lZCBrZXJuZWwKPj4+Pj4+Pj4gbW9kdWxlcywgYnV0IGl0IGRpZCBtb3Jl IHRoYW4gdGhhdCBhbmQgYnJva2UgdGhlIGtleWN0bCBBUEkuCj4+Pj4+Pj4+Cj4+Pj4+Pj4gV2hp Y2ggc3BlY2lmaWMgQVBJIGlzIGl3ZCB1c2luZyB0aGF0IGlzIHJlbGV2YW50IGhlcmU/Cj4+Pj4+ Pj4gSSBjbG9uZWQgaHR0cHM6Ly9rZXJuZWwuZ29vZ2xlc291cmNlLmNvbS9wdWIvc2NtL25ldHdv cmsvd2lyZWxlc3MvaXdkCj4+Pj4+Pj4gYW5kIGdyZXBwZWQgZm9yIGtleWN0bCBhbmQgQUZfQUxH LCBidXQgdGhlcmUgYXJlIG5vIG1hdGNoZXMuCj4+Pj4+PiBJV0QgdXNlcyBFTEwgZm9yIGl0cyBj cnlwdG8sIHdoaWNoIHVzZXMgdGhlIEFGX0FMRyBBUEk6Cj4+Pj4+Pgo+Pj4+Pj4gaHR0cHM6Ly9n aXQua2VybmVsLm9yZy9wdWIvc2NtL2xpYnMvZWxsL2VsbC5naXQvCj4+Pj4+IFRoYW5rcyBmb3Ig cG9pbnRpbmcgb3V0IHRoYXQgdGhlIHJlbGV2YW50IGNvZGUgaXMgcmVhbGx5IGluIHRoYXQgc2Vw YXJhdGUKPj4+Pj4gcmVwb3NpdG9yeS4gIE5vdGUsIGl0IHNlZW1zIHRoYXQga2V5Y3RsKCkgaXMg dGhlIHByb2JsZW0gaGVyZSwgbm90IEFGX0FMRy4gIFRoZQo+Pj4+PiBibGFtZWQgY29tbWl0IGRp ZG4ndCBjaGFuZ2UgYW55dGhpbmcgZm9yIEFGX0FMRy4KPj4+Pj4KPj4+Pj4+IEkgYmVsaWV2ZSB0 aGUgZmFpbHVyZSBpcyB3aGVuIGNhbGxpbmc6Cj4+Pj4+Pgo+Pj4+Pj4gS0VZQ1RMX1BLRVlfUVVF UlkgZW5jPSJ4OTYyIiBoYXNoPSJzaGExIgo+Pj4+Pj4KPj4+Pj4+ICAgRnJvbSBsb2dzIE1pY2hh ZWwgcG9zdGVkIG9uIHRoZSBJV0QgbGlzdCwgdGhlIEVMTCBBUEkgdGhhdCBmYWlscyBpczoKPj4+ Pj4+Cj4+Pj4+PiBsX2tleV9nZXRfaW5mbyAoZWxsLmdpdC9lbGwva2V5LmM6NDE2KQo+Pj4+PiBP a2F5LCBJIGd1ZXNzIHRoYXQncyB3aGF0J3MgYWN0dWFsbHkgY2F1c2luZyB0aGUgcHJvYmxlbS4g IEtFWUNUTF9QS0VZXyogYXJlIGEKPj4+Pj4gd2VpcmQgc2V0IG9mIEFQSXMgd2hlcmUgdXNlcnNw YWNlIGNhbiBhc2sgdGhlIGtlcm5lbCB0byBkbyBhc3ltbWV0cmljIGtleQo+Pj4+PiBvcGVyYXRp b25zLiAgSXQncyB1bmNsZWFyIHdoeSB0aGV5IGV4aXN0LCBhcyB0aGUgc2FtZSBmdW5jdGlvbmFs aXR5IGlzIGF2YWlsYWJsZQo+Pj4+PiBpbiB1c2Vyc3BhY2UgY3J5cHRvIGxpYnJhcmllcy4KPj4+ Pj4KPj4+Pj4gSSBzdXBwb3NlIHRoYXQgdGhlIGJsYW1lZCBjb21taXQsIG9yIGF0IGxlYXN0IHBh cnQgb2YgaXQsIHdpbGwgbmVlZCB0byBiZQo+Pj4+PiByZXZlcnRlZCB0byBrZWVwIHRoZXNlIHdl aXJkIGtleWN0bHMgd29ya2luZy4KPj4+Pj4KPj4+Pj4gRm9yIHRoZSBmdXR1cmUsIHdoeSBkb2Vz bid0IGl3ZCBqdXN0IHVzZSBhIHVzZXJzcGFjZSBjcnlwdG8gbGlicmFyeSBzdWNoIGFzCj4+Pj4+ IE9wZW5TU0w/Cj4+Pj4gSSB3YXMgbm90IGFyb3VuZCB3aGVuIHRoZSBvcmlnaW5hbCBkZWNpc2lv biB3YXMgbWFkZSwgYnV0IGEgZmV3IHJlYXNvbnMgSQo+Pj4+IGtub3cgd2UgZG9uJ3QgdXNlIG9w ZW5TU0w6Cj4+Pj4KPj4+PiAgwqAtIElXRCBoYXMgdmlydHVhbGx5IHplcm8gZGVwZW5kZW5jaWVz Lgo+Pj4gRGVwZW5kaW5nIG9uIHNvbWV0aGluZyBpbiB0aGUga2VybmVsIGRvZXMgbm90IGVsaW1p bmF0ZSBhIGRlcGVuZGVuY3k7IGl0IGp1c3QKPj4+IGFkZHMgdGhhdCBwYXJ0aWN1bGFyIGtlcm5l bCBVQVBJIHRvIHlvdXIgbGlzdCBvZiBkZXBlbmRlbmNpZXMuICBUaGUgcmVhc29uIHRoYXQKPj4+ IHdlJ3JlIGhhdmluZyB0aGlzIGRpc2N1c3Npb24gaW4gdGhlIGZpcnN0IHBsYWNlIGlzIGJlY2F1 c2UgaXdkIGlzIGRlcGVuZGluZyBvbgo+Pj4gYW4gb2JzY3VyZSBrZXJuZWwgVUFQSSB0aGF0IGlz IG5vdCB3ZWxsIGRlZmluZWQuICBIaXN0b3JpY2FsbHkgaXQncyBiZWVuIGhhcmQgdG8KPj4+IGF2 b2lkICJicmVha2luZyIgY2hhbmdlcyBpbiB0aGVzZSBjcnlwdG8tcmVsYXRlZCBVQVBJcyBiZWNh dXNlIG9mIHRoZSBwb29yCj4+PiBkZXNpZ24gd2hlcmUgYSBodWdlIG51bWJlciBvZiBhbGdvcml0 aG1zIGFyZSBwb3RlbnRpYWxseSBzdXBwb3J0ZWQsIGJ1dCB0aGUgbGlzdAo+Pj4gaXMgdW5kb2N1 bWVudGVkIGFuZCBpdCB2YXJpZXMgZnJvbSBvbmUgc3lzdGVtIHRvIGFub3RoZXIgYmFzZWQgb24g Y29uZmlndXJhdGlvbi4KPj4+IEFsc28gZHVlIHRvIHRoZWlyIG9ic2N1cml0eSBtYW55IGtlcm5l bCBkZXZlbG9wZXJzIGRvbid0IGtub3cgdGhhdCB0aGVzZSBVQVBJcwo+Pj4gZXZlbiBleGlzdC4g IChUaGUgcmVhY3Rpb24gd2hlbiBzb21lb25lIGZpbmRzIG91dCBpcyB1c3VhbGx5ICJXaHkhPyIp Cj4+Pgo+Pj4gSXQgbWF5IGJlIHdvcnRoIGxvb2tpbmcgYXQgaWYgaXdkIHNob3VsZCBtYWtlIGEg ZGlmZmVyZW50IGNob2ljZSBmb3IgdGhpcwo+Pj4gZGVwZW5kZW5jeS4gIEl0J3MgdW5kZXJzdGFu ZGFibGUgdG8gYmxhbWUgZGVwZW5kZW5jaWVzIHdoZW4gdGhpbmdzIGdvIHdyb25nLCBidXQKPj4+ IGF0IHRoZSBzYW1lIHRpbWUgdGhlIGNob2ljZSBvZiBkZXBlbmRlbmN5IGlzIHZlcnkgbXVjaCBh IGNob2ljZSwgYW5kIHNvbWUKPj4+IGNob2ljZXMgY2FuIGJlIG1vcmUgdGVjaG5pY2FsbHkgc291 bmQgYW5kIGNhdXNlIGZld2VyIHByb2JsZW1zIHRoYW4gb3RoZXJzLi4uCj4+Pgo+Pj4+ICDCoC0g T3BlblNTTCArIGZyaWVuZHMgYXJlIHJhdGhlciBsYXJnZSBsaWJyYXJpZXMuCj4+PiBUaGUgTGlu dXgga2VybmVsIGlzIGFsc28gbGFyZ2UsIGFuZCBpdCdzIG1hZGUgbGFyZ2VyIGJ5IGhhdmluZyB0 byBzdXBwb3J0Cj4+PiBvYnNvbGV0ZSBjcnlwdG8gYWxnb3JpdGhtcyBmb3IgYmFja3dhcmRzIGNv bXBhdGliaWxpdHkgd2l0aCBpd2QuCj4+Pgo+Pj4+ICDCoC0gQUZfQUxHIGhhcyB0cmFuc3BhcmVu dCBoYXJkd2FyZSBhY2NlbGVyYXRpb24gKG5vdCBzdXJlIGlmIG9wZW5TU0wgZG9lcwo+Pj4+IHRv bykuCj4+PiBPcGVuU1NMIHRha2VzIGFkdmFudGFnZSBvZiBDUFUtYmFzZWQgaGFyZHdhcmUgYWNj ZWxlcmF0aW9uLCBlLmcuIEFFUy1OSS4KPj4+Cj4+Pj4gQW5vdGhlciBjb25zaWRlcmF0aW9uIGlz IG9uY2UgeW91IHN1cHBvcnQgb3BlblNTTCBzb21lb25lIHdhbnRzIHdvbGZTU0wsCj4+Pj4gdGhl biBib3JpbmdTU0wgZXRjLiBFdmVuIGlmIHVzZXJzIGltcGxlbWVudCBzdXBwb3J0IGl0IGp1c3Qg YmVjb21lcyBhIGh1Z2UKPj4+PiBidXJkZW4gdG8gY2FycnkgZm9yIHRoZSBwcm9qZWN0LiBKdXN0 IGxvb2sgYXQgd3BhX3N1cHBsaWNhbnQncyBzcmMvY3J5cHRvLwo+Pj4+IGZvbGRlciwgbmVhcmx5 IDQwayBMT0MgaW4gdGhlcmUsIGNvbXBhcmVkIHRvIEVMTCdzIGNyeXB0byBtb2R1bGVzIHdoaWNo IGlzCj4+Pj4gfjVrLiBZb3UgaGF2ZSB0byBzb3J0IG91dCBhbGwgdGhlIG5pdHR5IGdyaXR0eSBk ZXRhaWxzIG9mIGVhY2ggbGlicmFyeSwgYW5kCj4+Pj4gcHJvdmlkZSBhIGNvbW1vbiBkcml2ZXIv QVBJIGZvciB0aGUgY29yZSBjb2RlLCBkaWZmZXJlbmNlcyBiZXR3ZWVuIG9wZW5zc2wKPj4+PiB2 ZXJzaW9ucywgdGhlIGxpc3QgZ29lcyBvbi4KPj4+IFdoYXQgaXMgdGhlIHNwZWNpZmljIGZ1bmN0 aW9uYWxpdHkgdGhhdCB5b3UncmUgYWN0dWFsbHkgcmVseWluZyBvbiB0aGF0IHlvdQo+Pj4gdGhp bmsgd291bGQgbmVlZCA0MEsgbGluZXMgb2YgY29kZSB0byByZXBsYWNlLCBldmVuIHVzaW5nIE9w ZW5TU0w/ICBJIHNlZSB5b3UKPj4+IGFyZSB1c2luZyBLRVlDVExfUEtFWV8qLCBidXQgd2hhdCBz cGVjaWZpY2FsbHkgYXJlIHlvdSB1c2luZyB0aGVtIGZvcj8gIFdoYXQKPj4+IG9wZXJhdGlvbnMg YXJlIGJlaW5nIHBlcmZvcm1lZCwgYW5kIHdpdGggd2hpY2ggYWxnb3JpdGhtcyBhbmQga2V5IGZv cm1hdHM/Cj4+PiBBbHNvLCBpcyB0aGUga2VybmVsIGJlaGF2aW9yIHRoYXQgeW91J3JlIHJlbHlp bmcgb24gZG9jdW1lbnRlZCBhbnl3aGVyZT8gIFRoZXJlCj4+PiBhcmUgbWFuIHBhZ2VzIGZvciB0 aG9zZSBrZXljdGxzLCBidXQgdGhleSBkb24ndCBzYXkgYW55dGhpbmcgYWJvdXQgYW55Cj4+PiBw YXJ0aWN1bGFyIGhhc2ggYWxnb3JpdGhtLCBTSEEtMSBvciBvdGhlcndpc2UsIGJlaW5nIHN1cHBv cnRlZC4KPj4gPGh0dHBzOi8vbG9yZS5rZXJuZWwub3JnL2FsbC9DQSs1NWFGeFc3Tk1BTXZZaGt2 ejFVUGJVVFVKZXdSdDZZYjUxUUF4NVJ0cldPd2plYmdAbWFpbC5nbWFpbC5jb20vPgo+PiAiQW5k IHdlIHNpbXBseSBkbyBub3QgYnJlYWsgdXNlciBzcGFjZS4iCj4+IC1MaW51cyBUb3J2YWxkcwo+ Pgo+PiBJcyB0aGlzIG5vIGxvbmdlciBhcHBsaWNhYmxlPwo+Pgo+IEFzIEkgc2FpZCwgdGhlIGNv bW1pdCwgb3IgYXQgbGVhc3QgdGhlIHBhcnQgb2YgaXQgdGhhdCBicm9rZSBpd2QgKGl0J3Mgbm90 IGNsZWFyCj4gdGhhdCBpdCdzIHRoZSB3aG9sZSBjb21taXQpLCBuZWVkcyB0byBiZSByZXZlcnRl ZC4KPgo+IEkganVzdCBob3BlIHRoYXQsIHNpbXVsdGFuZW91c2x5LCB0aGUgaXdkIGRldmVsb3Bl cnMgd2lsbCBjb25zaWRlciBpbXByb3ZpbmcgdGhlCj4gZGVzaWduIG9mIGl3ZCB0byBhdm9pZCB0 aGlzIHR5cGUgb2YgcmVjdXJyaW5nIGlzc3VlIGluIHRoZSBmdXR1cmUuICBBZnRlciBhbGwsCj4g dGhpcyBtYXkgYmUgdGhlIG9ubHkgcmVhbCBjaGFuY2UgZm9yIHN1Y2ggYSBkaXNjdXNzaW9uIGJl Zm9yZSB0aGUgbmV4dCB0aW1lIGl3ZAo+IGJyZWFrcy4KPgo+IEFsc28sIHBhcnQgb2YgdGhlIHJl YXNvbiBJJ20gYXNraW5nIGFib3V0IHdoYXQgZnVuY3Rpb25hbGl0eSB0aGF0IGl3ZCBpcyByZWx5 aW5nCj4gb24gaXMgc28gdGhhdCwgaWYgbmVjZXNzYXJ5LCBpdCBjYW4gYmUgcHJvcGVybHkgZG9j dW1lbnRlZCBhbmQgc3VwcG9ydGVkLi4uCj4KPiBJZiB3ZSBkb24ndCBrbm93IHdoYXQgd2UgYXJl IHN1cHBvcnRpbmcsIGl0IGlzIHZlcnkgaGFyZCB0byBzdXBwb3J0IGl0LgoKSVdEIHVzZXMgQUZf QUxHL2tleWN0bCBmb3IgX2FsbF8gaXRzIGNyeXB0bywgY2lwaGVyLCBhbmQgY2hlY2tzdW0gbmVl ZHMuIApBbnl0aGluZyB0aGF0IHdpZmkgcmVxdWlyZXMgYXMgZmFyIGFzIGNyeXB0byBnb2VzIElX RCB1c2VzIHRoZSBrZXJuZWwsIApleGNlcHQgRUNDIGlzIHRoZSBvbmx5IGV4Y2VwdGlvbi4gVGhl IGVudGlyZSBsaXN0IG9mIGNyeXB0byByZXF1aXJlbWVudHMgCihmb3IgZnVsbCBzdXBwb3J0IGF0 IGxlYXN0KSBmb3IgSVdEIGlzIGhlcmU6CgpodHRwczovL2dpdC5rZXJuZWwub3JnL3B1Yi9zY20v bmV0d29yay93aXJlbGVzcy9pd2QuZ2l0L3RyZWUvdG9vbHMvdGVzdF9ydW5uZXJfa2VybmVsX2Nv bmZpZwoKRm9yIEtFWUNUTF9QS0VZXyogc3BlY2lmaWNhbGx5IHdlIHVzZSBpdCBmb3IgYWxsIGFz eW1tZXRyaWMgY3J5cHRvIApvcGVyYXRpb25zLCAocXVlcnkpLCBlbmNyeXB0LCBkZWNyeXB0LCBz aWduLCB2ZXJpZnkuCgpJJ2xsIGJlIGhvbmVzdCwgdGhlIEFGX0FMRy9rZXljdGwgc3VwcG9ydCBp biBFTEwgd2FzIG1vc3RseSBkb25lIGJ5IHRoZSAKdGltZSBJIHN0YXJ0ZWQgd29ya2luZyBvbiBJ V0Qgc28gSSB3YXMgbm90IGF3YXJlIHRoZSBkb2N1bWVudGF0aW9uIHdhcyAKc28gcG9vci4gVGhh dCBpcyBhbiBlbnRpcmVseSBzZXBhcmF0ZSBpc3N1ZSB0aGFuIHRoaXMgSU1PLCBhbmQgSSdtIGhh cHB5IAp0byBoZWxwIHdpdGggZ2V0dGluZyBkb2NzIHVwZGF0ZWQgdG8gaW5jbHVkZSBhIHByb3Bl ciBsaXN0IG9mIHN1cHBvcnRlZCAKZmVhdHVyZXMuIEluIGFkZGl0aW9uIG1heWJlIHNvbWUgYXV0 b21hdGVkIHRlc3RpbmcgdGhhdCBnZXRzIHJ1biBvbiAKa2VybmVsIGJ1aWxkcyB3aGljaCBhY3R1 YWxseSBleGVyY2lzZXMgdGhpcyBBUEkgc28gaXQgZG9lc24ndCBnZXQgCmFjY2lkZW50YWxseSBn ZXQgYnJva2VuIGluIHRoZSBmdXR1cmU/IERvY3MvdGVzdHMgSU1PIGFyZSB0aGUgcHJvcGVyIAoi Zml4IiBoZXJlLCBub3QgdGVsbGluZyBzb21lb25lIHRvIHN0b3AgdXNpbmcgYW4gQVBJIHRoYXQg aGFzIGV4aXN0ZWQgYSAKbG9uZyB0aW1lLgoKSSdtIGFsc28gbm90IGVudGlyZWx5IHN1cmUgd2h5 IHRoaXMgc3R1ZmYgY29udGludWVzIHRvIGJlIHJlbW92ZWQgZnJvbSAKdGhlIGtlcm5lbC4gRmly c3QgTUQ0LCB0aGVuIGl0IGdvdCByZXZlcnRlZCwgdGhlbiB0aGlzIChub3cgcmV2ZXJ0ZWQsIAp0 aGFua3MpLiBCb3RoIGNhc2VzIHRoZXJlIHdhcyBub3QgY2xlYXIganVzdGlmaWNhdGlvbiBvZiB3 aHkgaXQgd2FzIApiZWluZyByZW1vdmVkLgoKVGhhbmtzLAoKSmFtZXMKCj4KPiAtIEVyaWMKPgoK X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KbGludXgtYXJt LWtlcm5lbCBtYWlsaW5nIGxpc3QKbGludXgtYXJtLWtlcm5lbEBsaXN0cy5pbmZyYWRlYWQub3Jn Cmh0dHA6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxtYW4vbGlzdGluZm8vbGludXgtYXJtLWtl cm5lbAo=