Content-Type: multipart/mixed; boundary="------------17Qq0enf9XBLO4YjkFWFmGec"
Message-ID: <00d46a48-3324-d9a0-49bf-e7f0f11d1038@timescale.com>
Date: Mon, 20 Mar 2023 09:44:24 -0700
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.7.1
From: Jacob Champion <jchampion@timescale.com>
Subject: pg_dump needs SELECT privileges on irrelevant extension table
Content-Language: en-US
To: PostgreSQL Bugs <pgsql-bugs@lists.postgresql.org>
Archived-At: 
 <https://www.postgresql.org/message-id/00d46a48-3324-d9a0-49bf-e7f0f11d1038%40timescale.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------17Qq0enf9XBLO4YjkFWFmGec
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

Hi all,

We have a situation where we need to revoke SELECT on a table that
belongs to our extension, and we also need to let less privileged users
dump the extension's external config tables. (The restricted table's
contents are exposed through a security_barrier view, and it's a cloud
environment where "admin" users don't necessarily have true superuser
access.)

Since the restricted table is internal, its contents aren't included in
dumps anyway, so we expected to be able to meet both use cases at once.
Unfortunately:

    $ pg_dump -U unprivileged_user -d postgres
    pg_dump: error: query failed: ERROR:  permission denied for relation
ext_table
    pg_dump: error: query was: LOCK TABLE public.ext_table IN ACCESS
SHARE MODE

...and there appears to be no way to work around this with
--exclude-table, since the table is part of the extension.

It looks like the only reason pg_dump locks this particular table is
because it's been marked with DUMP_COMPONENT_POLICY, which needs a lock
to ensure the consistency of later pg_get_expr() calls. That stings for
two reasons: 1) it doesn't seem like you need SELECT access on a table
to see its policies, and 2) we have no policies on the table anyway;
there are no pg_get_expr() calls to protect.

So I've attached the simplest backportable workaround I could think of:
unmark DUMP_COMPONENT_POLICY for a table that has no policies at the
time of the getTables() query. This is similar to the ACL optimization
that back branches do; it should ensure that there will be no
pg_get_expr() calls on pg_policy for that table later, due to
repeatable-read, and it omits the lock when there's no reason to grab
it. It won't fix the problem for tables that have do policies, but I
don't have any ideas for how to do that safely, unless there's some lock
mode that uses fewer privileges.

I also attached a speculative backport to 11 to illustrate what that
might look like, but first I have to convince you it's a bug. :)

WDYT?

Thanks,
--Jacob
--------------17Qq0enf9XBLO4YjkFWFmGec
Content-Type: text/x-patch; charset=UTF-8;
 name="0001-pg_dump-skip-lock-for-extension-tables-without-polic.patch"
Content-Disposition: attachment;
 filename*0="0001-pg_dump-skip-lock-for-extension-tables-without-polic.pa";
 filename*1="tch"
Content-Transfer-Encoding: base64

RnJvbSA4NjUxN2YzNzYzMzlhNjVmY2Y0MzJjYWEyMWRiYzY4ZDhjMmE5M2E0IE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBKYWNvYiBDaGFtcGlvbiA8amNoYW1waW9uQHRpbWVz
Y2FsZS5jb20+CkRhdGU6IFRodSwgMTYgTWFyIDIwMjMgMTE6NDY6MDggLTA3MDAKU3ViamVj
dDogW1BBVENIXSBwZ19kdW1wOiBza2lwIGxvY2sgZm9yIGV4dGVuc2lvbiB0YWJsZXMgd2l0
aG91dCBwb2xpY2llcwoKSWYgYSB1c2VyIHdpdGhvdXQgU0VMRUNUIHBlcm1pc3Npb25zIG9u
IGFuIGludGVybmFsIGV4dGVuc2lvbiB0YWJsZQp0cmllcyB0byBkdW1wIHRoZSBleHRlbnNp
b24sIHRoZSBkdW1wIHdpbGwgZmFpbCB3aGlsZSB0cnlpbmcgdG8gbG9jayB0aGUKdGFibGUg
d2l0aCBBQ0NFU1MgU0hBUkUsIGV2ZW4gdGhvdWdoIHRoZSB1c2VyIGRvZXNuJ3Qgd2FudCBv
ciBuZWVkIHRvCmR1bXAgdGhlIHRhYmxlIGluIHF1ZXN0aW9uLiAoVGhlIGxvY2sgaXMgdGFr
ZW4gdG8gYWxsb3cgbGF0ZXIKcGdfZ2V0X2V4cHIoKSBjYWxscyBvbiBwZ19wb2xpY3kgdG8g
cmVtYWluIGNvbnNpc3RlbnQgaW4gdGhlIGZhY2Ugb2YKY29uY3VycmVudCBzY2hlbWEgY2hh
bmdlcy4pCgpJdCdkIGJlIGlkZWFsIG5vdCB0byByZXF1aXJlIFNFTEVDVCBwZXJtaXNzaW9u
cyBvbiBhIHRhYmxlIHRvIGJlIGFibGUgdG8KZHVtcCBpdHMgcG9saWNpZXMsIGJ1dCBJIGRv
bid0IGhhdmUgYSBncmVhdCBpZGVhIGZvciBob3cgdG8gaW1wbGVtZW50CnRoYXQgd2l0aG91
dCByYWNlcy4gQXMgYSB3b3JrYXJvdW5kLCBza2lwIHRoZSBwb2xpY3kgcXVlcmllcyBlbnRp
cmVseSBpZgp3ZSBkZXRlcm1pbmUgdGhhdCBubyBwb2xpY2llcyBleGlzdCBmb3IgYSB0YWJs
ZSBhdCB0aGUgdGltZSBvZgpnZXRUYWJsZXMoKS4KLS0tCiBzcmMvYmluL3BnX2R1bXAvcGdf
ZHVtcC5jIHwgMjAgKysrKysrKysrKysrKysrKysrKysKIDEgZmlsZSBjaGFuZ2VkLCAyMCBp
bnNlcnRpb25zKCspCgpkaWZmIC0tZ2l0IGEvc3JjL2Jpbi9wZ19kdW1wL3BnX2R1bXAuYyBi
L3NyYy9iaW4vcGdfZHVtcC9wZ19kdW1wLmMKaW5kZXggMmUwNjhjNjYyMC4uNDlmMDEyNDdj
MSAxMDA2NDQKLS0tIGEvc3JjL2Jpbi9wZ19kdW1wL3BnX2R1bXAuYworKysgYi9zcmMvYmlu
L3BnX2R1bXAvcGdfZHVtcC5jCkBAIC02MzE3LDYgKzYzMTcsNyBAQCBnZXRUYWJsZXMoQXJj
aGl2ZSAqZm91dCwgaW50ICpudW1UYWJsZXMpCiAJaW50CQkJaV9yZWxhY2w7CiAJaW50CQkJ
aV9hY2xkZWZhdWx0OwogCWludAkJCWlfaXNwYXJ0aXRpb247CisJaW50CQkJaV9oYXNfcG9s
aWNpZXM7CiAKIAkvKgogCSAqIEZpbmQgYWxsIHRoZSB0YWJsZXMgYW5kIHRhYmxlLWxpa2Ug
b2JqZWN0cy4KQEAgLTYzNTgsNiArNjM1OSwxMyBAQCBnZXRUYWJsZXMoQXJjaGl2ZSAqZm91
dCwgaW50ICpudW1UYWJsZXMpCiAJCQkJCQkgImQucmVmb2Jqc3ViaWQgQVMgb3duaW5nX2Nv
bCwgIgogCQkJCQkJICJ0c3Auc3BjbmFtZSBBUyByZWx0YWJsZXNwYWNlLCAiKTsKIAorCWlm
IChmb3V0LT5yZW1vdGVWZXJzaW9uID49IDkwNTAwKQorCQlhcHBlbmRQUUV4cEJ1ZmZlclN0
cihxdWVyeSwKKwkJCQkJCQkgIkVYSVNUUyAoU0VMRUNUIDEgRlJPTSBwZ19wb2xpY3kgV0hF
UkUgcG9scmVsaWQgPSBjLm9pZCkgQVMgaGFzX3BvbGljaWVzLCAiKTsKKwllbHNlCisJCWFw
cGVuZFBRRXhwQnVmZmVyU3RyKHF1ZXJ5LAorCQkJCQkJCSAiZmFsc2UgQVMgaGFzX3BvbGlj
aWVzLCAiKTsKKwogCWlmIChmb3V0LT5yZW1vdGVWZXJzaW9uID49IDEyMDAwMCkKIAkJYXBw
ZW5kUFFFeHBCdWZmZXJTdHIocXVlcnksCiAJCQkJCQkJICJmYWxzZSBBUyByZWxoYXNvaWRz
LCAiKTsKQEAgLTY1MzEsNiArNjUzOSw3IEBAIGdldFRhYmxlcyhBcmNoaXZlICpmb3V0LCBp
bnQgKm51bVRhYmxlcykKIAlpX3JlbGFjbCA9IFBRZm51bWJlcihyZXMsICJyZWxhY2wiKTsK
IAlpX2FjbGRlZmF1bHQgPSBQUWZudW1iZXIocmVzLCAiYWNsZGVmYXVsdCIpOwogCWlfaXNw
YXJ0aXRpb24gPSBQUWZudW1iZXIocmVzLCAiaXNwYXJ0aXRpb24iKTsKKwlpX2hhc19wb2xp
Y2llcyA9IFBRZm51bWJlcihyZXMsICJoYXNfcG9saWNpZXMiKTsKIAogCWlmIChkb3B0LT5s
b2NrV2FpdFRpbWVvdXQpCiAJewpAQCAtNjYyMSw2ICs2NjMwLDE3IEBAIGdldFRhYmxlcyhB
cmNoaXZlICpmb3V0LCBpbnQgKm51bVRhYmxlcykKIAkJZWxzZQogCQkJc2VsZWN0RHVtcGFi
bGVUYWJsZSgmdGJsaW5mb1tpXSwgZm91dCk7CiAKKwkJLyoKKwkJICogSWYgdGhlIHRhYmxl
IGhhcyBubyBwb2xpY2llcywgd2UgZG9uJ3QgbmVlZCB0byB3b3JyeSBhYm91dCB0aG9zZS4K
KwkJICoKKwkJICogRm9yIHRhYmxlcyBpbnRlcm5hbCB0byBhbiBleHRlbnNpb24sIHRoaXMg
bWF5IG1lYW4gd2UgZG9uJ3QgbmVlZCB0bworCQkgKiB0YWtlIGFuIEFDQ0VTUyBTSEFSRSBs
b2NrLCB3aGljaCBpbiB0dXJuIGFsbG93cyBsZXNzIHByaXZpbGVnZWQgdXNlcnMKKwkJICog
dG8gc3VjY2Vzc2Z1bGx5IHBlcmZvcm0gYSBkdW1wIGlmIHRoZXkgZG9uJ3QgaGF2ZSBTRUxF
Q1QgYWNjZXNzIHRvCisJCSAqIHRob3NlIHRhYmxlcyAod2hpY2ggdGhleSB3ZXJlbid0IHRy
eWluZyB0byBkdW1wIGluIHRoZSBmaXJzdCBwbGFjZSkuCisJCSAqLworCQlpZiAoc3RyY21w
KFBRZ2V0dmFsdWUocmVzLCBpLCBpX2hhc19wb2xpY2llcyksICJmIikgPT0gMCkKKwkJCXRi
bGluZm9baV0uZG9iai5kdW1wICY9IH5EVU1QX0NPTVBPTkVOVF9QT0xJQ1k7CisKIAkJLyoK
IAkJICogTm93LCBjb25zaWRlciB0aGUgdGFibGUgImludGVyZXN0aW5nIiBpZiB3ZSBuZWVk
IHRvIGR1bXAgaXRzCiAJCSAqIGRlZmluaXRpb24gb3IgaXRzIGRhdGEuICBMYXRlciBvbiwg
d2UnbGwgc2tpcCBhIGxvdCBvZiBkYXRhCi0tIAoyLjI1LjEKCg==
--------------17Qq0enf9XBLO4YjkFWFmGec
Content-Type: text/x-patch; charset=UTF-8;
 name="0001-pg_dump-skip-lock-for-extension-tables-without-polic.REL_11_STABLE.patch"
Content-Disposition: attachment;
 filename*0="0001-pg_dump-skip-lock-for-extension-tables-without-polic.RE";
 filename*1="L_11_STABLE.patch"
Content-Transfer-Encoding: base64

RnJvbSBmZmRiOGJhYzEwZWNmNDBjNDBhM2U4YzQ0MWUyOTk0MjNlZTA3Y2VmIE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBKYWNvYiBDaGFtcGlvbiA8amNoYW1waW9uQHRpbWVz
Y2FsZS5jb20+CkRhdGU6IFRodSwgMTYgTWFyIDIwMjMgMTE6NDY6MDggLTA3MDAKU3ViamVj
dDogW1BBVENIXSBwZ19kdW1wOiBza2lwIGxvY2sgZm9yIGV4dGVuc2lvbiB0YWJsZXMgd2l0
aG91dCBwb2xpY2llcwoKW2JhY2twb3J0IHRvIDExXQoKSWYgYSB1c2VyIHdpdGhvdXQgU0VM
RUNUIHBlcm1pc3Npb25zIG9uIGFuIGludGVybmFsIGV4dGVuc2lvbiB0YWJsZQp0cmllcyB0
byBkdW1wIHRoZSBleHRlbnNpb24sIHRoZSBkdW1wIHdpbGwgZmFpbCB3aGlsZSB0cnlpbmcg
dG8gbG9jayB0aGUKdGFibGUgd2l0aCBBQ0NFU1MgU0hBUkUsIGV2ZW4gdGhvdWdoIHRoZSB1
c2VyIGRvZXNuJ3Qgd2FudCBvciBuZWVkIHRvCmR1bXAgdGhlIHRhYmxlIGluIHF1ZXN0aW9u
LiAoVGhlIGxvY2sgaXMgdGFrZW4gdG8gYWxsb3cgbGF0ZXIKcGdfZ2V0X2V4cHIoKSBjYWxs
cyBvbiBwZ19wb2xpY3kgdG8gcmVtYWluIGNvbnNpc3RlbnQgaW4gdGhlIGZhY2Ugb2YKY29u
Y3VycmVudCBzY2hlbWEgY2hhbmdlcy4pCgpJdCdkIGJlIGlkZWFsIG5vdCB0byByZXF1aXJl
IFNFTEVDVCBwZXJtaXNzaW9ucyBvbiBhIHRhYmxlIHRvIGJlIGFibGUgdG8KZHVtcCBpdHMg
cG9saWNpZXMsIGJ1dCBJIGRvbid0IGhhdmUgYSBncmVhdCBpZGVhIGZvciBob3cgdG8gaW1w
bGVtZW50CnRoYXQgd2l0aG91dCByYWNlcy4gQXMgYSB3b3JrYXJvdW5kLCBza2lwIHRoZSBw
b2xpY3kgcXVlcmllcyBlbnRpcmVseSBpZgp3ZSBkZXRlcm1pbmUgdGhhdCBubyBwb2xpY2ll
cyBleGlzdCBmb3IgYSB0YWJsZSBhdCB0aGUgdGltZSBvZgpnZXRUYWJsZXMoKS4KLS0tCiBz
cmMvYmluL3BnX2R1bXAvcGdfZHVtcC5jIHwgNDEgKysrKysrKysrKysrKysrKysrKysrKysr
KysrKysrLS0tLS0tLS0tCiAxIGZpbGUgY2hhbmdlZCwgMzIgaW5zZXJ0aW9ucygrKSwgOSBk
ZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9zcmMvYmluL3BnX2R1bXAvcGdfZHVtcC5jIGIv
c3JjL2Jpbi9wZ19kdW1wL3BnX2R1bXAuYwppbmRleCA1NmQ1NTcxMzY2Li4xMjVjNjAzOGM2
IDEwMDY0NAotLS0gYS9zcmMvYmluL3BnX2R1bXAvcGdfZHVtcC5jCisrKyBiL3NyYy9iaW4v
cGdfZHVtcC9wZ19kdW1wLmMKQEAgLTU5ODIsNiArNTk4Miw3IEBAIGdldFRhYmxlcyhBcmNo
aXZlICpmb3V0LCBpbnQgKm51bVRhYmxlcykKIAlpbnQJCQlpX2lzX2lkZW50aXR5X3NlcXVl
bmNlOwogCWludAkJCWlfY2hhbmdlZF9hY2w7CiAJaW50CQkJaV9pc3BhcnRpdGlvbjsKKwlp
bnQJCQlpX2hhc19wb2xpY2llczsKIAogCS8qCiAJICogRmluZCBhbGwgdGhlIHRhYmxlcyBh
bmQgdGFibGUtbGlrZSBvYmplY3RzLgpAQCAtNjA4MSw3ICs2MDgyLDggQEAgZ2V0VGFibGVz
KEFyY2hpdmUgKmZvdXQsIGludCAqbnVtVGFibGVzKQogCQkJCQkJICAiT1IgJXMgSVMgTk9U
IE5VTEwiCiAJCQkJCQkgICIpKSIKIAkJCQkJCSAgIkFTIGNoYW5nZWRfYWNsLCAiCi0JCQkJ
CQkgICIlcyBBUyBpc3BhcnRpdGlvbiAiCisJCQkJCQkgICIlcyBBUyBpc3BhcnRpdGlvbiwg
IgorCQkJCQkJICAiRVhJU1RTIChTRUxFQ1QgMSBGUk9NIHBnX3BvbGljeSBXSEVSRSBwb2xy
ZWxpZCA9IGMub2lkKSBBUyBoYXNfcG9saWNpZXMgIgogCQkJCQkJICAiRlJPTSBwZ19jbGFz
cyBjICIKIAkJCQkJCSAgIkxFRlQgSk9JTiBwZ19kZXBlbmQgZCBPTiAiCiAJCQkJCQkgICIo
Yy5yZWxraW5kID0gJyVjJyBBTkQgIgpAQCAtNjE1Miw3ICs2MTU0LDggQEAgZ2V0VGFibGVz
KEFyY2hpdmUgKmZvdXQsIGludCAqbnVtVGFibGVzKQogCQkJCQkJICAiV0hFTiAnY2hlY2tf
b3B0aW9uPWNhc2NhZGVkJyA9IEFOWSAoYy5yZWxvcHRpb25zKSBUSEVOICdDQVNDQURFRCc6
OnRleHQgRUxTRSBOVUxMIEVORCBBUyBjaGVja29wdGlvbiwgIgogCQkJCQkJICAidGMucmVs
b3B0aW9ucyBBUyB0b2FzdF9yZWxvcHRpb25zLCAiCiAJCQkJCQkgICJOVUxMIEFTIGNoYW5n
ZWRfYWNsLCAiCi0JCQkJCQkgICJmYWxzZSBBUyBpc3BhcnRpdGlvbiAiCisJCQkJCQkgICJm
YWxzZSBBUyBpc3BhcnRpdGlvbiwgIgorCQkJCQkJICAiRVhJU1RTIChTRUxFQ1QgMSBGUk9N
IHBnX3BvbGljeSBXSEVSRSBwb2xyZWxpZCA9IGMub2lkKSBBUyBoYXNfcG9saWNpZXMgIgog
CQkJCQkJICAiRlJPTSBwZ19jbGFzcyBjICIKIAkJCQkJCSAgIkxFRlQgSk9JTiBwZ19kZXBl
bmQgZCBPTiAiCiAJCQkJCQkgICIoYy5yZWxraW5kID0gJyVjJyBBTkQgIgpAQCAtNjE5OSw3
ICs2MjAyLDggQEAgZ2V0VGFibGVzKEFyY2hpdmUgKmZvdXQsIGludCAqbnVtVGFibGVzKQog
CQkJCQkJICAiV0hFTiAnY2hlY2tfb3B0aW9uPWNhc2NhZGVkJyA9IEFOWSAoYy5yZWxvcHRp
b25zKSBUSEVOICdDQVNDQURFRCc6OnRleHQgRUxTRSBOVUxMIEVORCBBUyBjaGVja29wdGlv
biwgIgogCQkJCQkJICAidGMucmVsb3B0aW9ucyBBUyB0b2FzdF9yZWxvcHRpb25zLCAiCiAJ
CQkJCQkgICJOVUxMIEFTIGNoYW5nZWRfYWNsLCAiCi0JCQkJCQkgICJmYWxzZSBBUyBpc3Bh
cnRpdGlvbiAiCisJCQkJCQkgICJmYWxzZSBBUyBpc3BhcnRpdGlvbiwgIgorCQkJCQkJICAi
ZmFsc2UgQVMgaGFzX3BvbGljaWVzICIKIAkJCQkJCSAgIkZST00gcGdfY2xhc3MgYyAiCiAJ
CQkJCQkgICJMRUZUIEpPSU4gcGdfZGVwZW5kIGQgT04gIgogCQkJCQkJICAiKGMucmVsa2lu
ZCA9ICclYycgQU5EICIKQEAgLTYyNDYsNyArNjI1MCw4IEBAIGdldFRhYmxlcyhBcmNoaXZl
ICpmb3V0LCBpbnQgKm51bVRhYmxlcykKIAkJCQkJCSAgIldIRU4gJ2NoZWNrX29wdGlvbj1j
YXNjYWRlZCcgPSBBTlkgKGMucmVsb3B0aW9ucykgVEhFTiAnQ0FTQ0FERUQnOjp0ZXh0IEVM
U0UgTlVMTCBFTkQgQVMgY2hlY2tvcHRpb24sICIKIAkJCQkJCSAgInRjLnJlbG9wdGlvbnMg
QVMgdG9hc3RfcmVsb3B0aW9ucywgIgogCQkJCQkJICAiTlVMTCBBUyBjaGFuZ2VkX2FjbCwg
IgotCQkJCQkJICAiZmFsc2UgQVMgaXNwYXJ0aXRpb24gIgorCQkJCQkJICAiZmFsc2UgQVMg
aXNwYXJ0aXRpb24sICIKKwkJCQkJCSAgImZhbHNlIEFTIGhhc19wb2xpY2llcyAiCiAJCQkJ
CQkgICJGUk9NIHBnX2NsYXNzIGMgIgogCQkJCQkJICAiTEVGVCBKT0lOIHBnX2RlcGVuZCBk
IE9OICIKIAkJCQkJCSAgIihjLnJlbGtpbmQgPSAnJWMnIEFORCAiCkBAIC02MjkxLDcgKzYy
OTYsOCBAQCBnZXRUYWJsZXMoQXJjaGl2ZSAqZm91dCwgaW50ICpudW1UYWJsZXMpCiAJCQkJ
CQkgICJjLnJlbG9wdGlvbnMgQVMgcmVsb3B0aW9ucywgIgogCQkJCQkJICAidGMucmVsb3B0
aW9ucyBBUyB0b2FzdF9yZWxvcHRpb25zLCAiCiAJCQkJCQkgICJOVUxMIEFTIGNoYW5nZWRf
YWNsLCAiCi0JCQkJCQkgICJmYWxzZSBBUyBpc3BhcnRpdGlvbiAiCisJCQkJCQkgICJmYWxz
ZSBBUyBpc3BhcnRpdGlvbiwgIgorCQkJCQkJICAiZmFsc2UgQVMgaGFzX3BvbGljaWVzICIK
IAkJCQkJCSAgIkZST00gcGdfY2xhc3MgYyAiCiAJCQkJCQkgICJMRUZUIEpPSU4gcGdfZGVw
ZW5kIGQgT04gIgogCQkJCQkJICAiKGMucmVsa2luZCA9ICclYycgQU5EICIKQEAgLTYzMzYs
NyArNjM0Miw4IEBAIGdldFRhYmxlcyhBcmNoaXZlICpmb3V0LCBpbnQgKm51bVRhYmxlcykK
IAkJCQkJCSAgImMucmVsb3B0aW9ucyBBUyByZWxvcHRpb25zLCAiCiAJCQkJCQkgICJ0Yy5y
ZWxvcHRpb25zIEFTIHRvYXN0X3JlbG9wdGlvbnMsICIKIAkJCQkJCSAgIk5VTEwgQVMgY2hh
bmdlZF9hY2wsICIKLQkJCQkJCSAgImZhbHNlIEFTIGlzcGFydGl0aW9uICIKKwkJCQkJCSAg
ImZhbHNlIEFTIGlzcGFydGl0aW9uLCAiCisJCQkJCQkgICJmYWxzZSBBUyBoYXNfcG9saWNp
ZXMgIgogCQkJCQkJICAiRlJPTSBwZ19jbGFzcyBjICIKIAkJCQkJCSAgIkxFRlQgSk9JTiBw
Z19kZXBlbmQgZCBPTiAiCiAJCQkJCQkgICIoYy5yZWxraW5kID0gJyVjJyBBTkQgIgpAQCAt
NjM4MCw3ICs2Mzg3LDggQEAgZ2V0VGFibGVzKEFyY2hpdmUgKmZvdXQsIGludCAqbnVtVGFi
bGVzKQogCQkJCQkJICAiYy5yZWxvcHRpb25zIEFTIHJlbG9wdGlvbnMsICIKIAkJCQkJCSAg
InRjLnJlbG9wdGlvbnMgQVMgdG9hc3RfcmVsb3B0aW9ucywgIgogCQkJCQkJICAiTlVMTCBB
UyBjaGFuZ2VkX2FjbCwgIgotCQkJCQkJICAiZmFsc2UgQVMgaXNwYXJ0aXRpb24gIgorCQkJ
CQkJICAiZmFsc2UgQVMgaXNwYXJ0aXRpb24sICIKKwkJCQkJCSAgImZhbHNlIEFTIGhhc19w
b2xpY2llcyAiCiAJCQkJCQkgICJGUk9NIHBnX2NsYXNzIGMgIgogCQkJCQkJICAiTEVGVCBK
T0lOIHBnX2RlcGVuZCBkIE9OICIKIAkJCQkJCSAgIihjLnJlbGtpbmQgPSAnJWMnIEFORCAi
CkBAIC02NDI0LDcgKzY0MzIsOCBAQCBnZXRUYWJsZXMoQXJjaGl2ZSAqZm91dCwgaW50ICpu
dW1UYWJsZXMpCiAJCQkJCQkgICJjLnJlbG9wdGlvbnMgQVMgcmVsb3B0aW9ucywgIgogCQkJ
CQkJICAiTlVMTCBBUyB0b2FzdF9yZWxvcHRpb25zLCAiCiAJCQkJCQkgICJOVUxMIEFTIGNo
YW5nZWRfYWNsLCAiCi0JCQkJCQkgICJmYWxzZSBBUyBpc3BhcnRpdGlvbiAiCisJCQkJCQkg
ICJmYWxzZSBBUyBpc3BhcnRpdGlvbiwgIgorCQkJCQkJICAiZmFsc2UgQVMgaGFzX3BvbGlj
aWVzICIKIAkJCQkJCSAgIkZST00gcGdfY2xhc3MgYyAiCiAJCQkJCQkgICJMRUZUIEpPSU4g
cGdfZGVwZW5kIGQgT04gIgogCQkJCQkJICAiKGMucmVsa2luZCA9ICclYycgQU5EICIKQEAg
LTY0NjcsNyArNjQ3Niw4IEBAIGdldFRhYmxlcyhBcmNoaXZlICpmb3V0LCBpbnQgKm51bVRh
YmxlcykKIAkJCQkJCSAgIk5VTEwgQVMgcmVsb3B0aW9ucywgIgogCQkJCQkJICAiTlVMTCBB
UyB0b2FzdF9yZWxvcHRpb25zLCAiCiAJCQkJCQkgICJOVUxMIEFTIGNoYW5nZWRfYWNsLCAi
Ci0JCQkJCQkgICJmYWxzZSBBUyBpc3BhcnRpdGlvbiAiCisJCQkJCQkgICJmYWxzZSBBUyBp
c3BhcnRpdGlvbiwgIgorCQkJCQkJICAiZmFsc2UgQVMgaGFzX3BvbGljaWVzICIKIAkJCQkJ
CSAgIkZST00gcGdfY2xhc3MgYyAiCiAJCQkJCQkgICJMRUZUIEpPSU4gcGdfZGVwZW5kIGQg
T04gIgogCQkJCQkJICAiKGMucmVsa2luZCA9ICclYycgQU5EICIKQEAgLTY1MzUsNiArNjU0
NSw3IEBAIGdldFRhYmxlcyhBcmNoaXZlICpmb3V0LCBpbnQgKm51bVRhYmxlcykKIAlpX2lz
X2lkZW50aXR5X3NlcXVlbmNlID0gUFFmbnVtYmVyKHJlcywgImlzX2lkZW50aXR5X3NlcXVl
bmNlIik7CiAJaV9jaGFuZ2VkX2FjbCA9IFBRZm51bWJlcihyZXMsICJjaGFuZ2VkX2FjbCIp
OwogCWlfaXNwYXJ0aXRpb24gPSBQUWZudW1iZXIocmVzLCAiaXNwYXJ0aXRpb24iKTsKKwlp
X2hhc19wb2xpY2llcyA9IFBRZm51bWJlcihyZXMsICJoYXNfcG9saWNpZXMiKTsKIAogCWlm
IChkb3B0LT5sb2NrV2FpdFRpbWVvdXQpCiAJewpAQCAtNjYyNyw2ICs2NjM4LDE4IEBAIGdl
dFRhYmxlcyhBcmNoaXZlICpmb3V0LCBpbnQgKm51bVRhYmxlcykKIAkJCXN0cmNtcChQUWdl
dHZhbHVlKHJlcywgaSwgaV9jaGFuZ2VkX2FjbCksICJmIikgPT0gMCkKIAkJCXRibGluZm9b
aV0uZG9iai5kdW1wICY9IH5EVU1QX0NPTVBPTkVOVF9BQ0w7CiAKKwkJLyoKKwkJICogU2lt
aWxhcmx5LCBpZiB0aGUgdGFibGUgaGFzIG5vIHBvbGljaWVzLCB3ZSBkb24ndCBuZWVkIHRv
IHdvcnJ5IGFib3V0CisJCSAqIHRob3NlIGVpdGhlci4KKwkJICoKKwkJICogRm9yIHRhYmxl
cyBpbnRlcm5hbCB0byBhbiBleHRlbnNpb24sIHRoaXMgbWF5IG1lYW4gd2UgZG9uJ3QgbmVl
ZCB0bworCQkgKiB0YWtlIGFuIEFDQ0VTUyBTSEFSRSBsb2NrLCB3aGljaCBpbiB0dXJuIGFs
bG93cyBsZXNzIHByaXZpbGVnZWQgdXNlcnMKKwkJICogdG8gc3VjY2Vzc2Z1bGx5IHBlcmZv
cm0gYSBkdW1wIGlmIHRoZXkgZG9uJ3QgaGF2ZSBTRUxFQ1QgYWNjZXNzIHRvCisJCSAqIHRo
b3NlIHRhYmxlcyAod2hpY2ggdGhleSB3ZXJlbid0IHRyeWluZyB0byBkdW1wIGluIHRoZSBm
aXJzdCBwbGFjZSkuCisJCSAqLworCQlpZiAoc3RyY21wKFBRZ2V0dmFsdWUocmVzLCBpLCBp
X2hhc19wb2xpY2llcyksICJmIikgPT0gMCkKKwkJCXRibGluZm9baV0uZG9iai5kdW1wICY9
IH5EVU1QX0NPTVBPTkVOVF9QT0xJQ1k7CisKIAkJdGJsaW5mb1tpXS5pbnRlcmVzdGluZyA9
IHRibGluZm9baV0uZG9iai5kdW1wID8gdHJ1ZSA6IGZhbHNlOwogCQl0YmxpbmZvW2ldLmR1
bW15X3ZpZXcgPSBmYWxzZTsJLyogbWlnaHQgZ2V0IHNldCBkdXJpbmcgc29ydCAqLwogCQl0
YmxpbmZvW2ldLnBvc3Rwb25lZF9kZWYgPSBmYWxzZTsJLyogbWlnaHQgZ2V0IHNldCBkdXJp
bmcgc29ydCAqLwotLSAKMi4yNS4xCgo=

--------------17Qq0enf9XBLO4YjkFWFmGec--