Received: from malur.postgresql.org ([2a02:16a8:dc51::56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1g74hP-0004Si-7z for pgsql-hackers@arkaria.postgresql.org; Mon, 01 Oct 2018 20:21:47 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1g74hM-0003ZV-AK for pgsql-hackers@arkaria.postgresql.org; Mon, 01 Oct 2018 20:21:44 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1g74hK-0003Z8-Un for pgsql-hackers@lists.postgresql.org; Mon, 01 Oct 2018 20:21:44 +0000 Received: from out3-smtp.messagingengine.com ([66.111.4.27]) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1g74hE-0008Lz-8k for pgsql-hackers@postgresql.org; Mon, 01 Oct 2018 20:21:42 +0000 Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id A724622013 for ; Mon, 1 Oct 2018 16:21:34 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute7.internal (MEProxy); Mon, 01 Oct 2018 16:21:34 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= fm3; bh=gDvw61X2aVmB9uiEfflvuv+H6/vHu6ucn90wPjxZYCM=; b=YV3B6PBZ 8DJPQ10ioZxaOYT2ClzXqQx8iNE3OHRBbHDhX2COzK4ou7qllhVkgHrcx5tiTSzZ dulKHluwMdgVuW9RkhqygkFfoThFd47oJkbO2JCAL3A4+yNKjhrY9Ip1rH6wZBrJ vtrNox9Un6PpQrEAeVefkcAYbTGlUm/ZPVnT+nNMLobIS/6+ruJyj8ybrtmNtcUn 06Xmsj6yvmWPqoPS/LvnJNBpQ9homII9kcWTOPcLrRIlg7uqZcLpe1n2nlEvdq8m fuRFqPCQ08sH4XwDy3WaOtqZBrj74w0bLpo/IDCdjwFArKg7kQR5PtmXiYRcLPWt 30WcgjT9wlfwsw== X-ME-Sender: X-ME-Proxy: Received: from april.pezone.net (p5df2a2d9.dip0.t-ipconnect.de [93.242.162.217]) by mail.messagingengine.com (Postfix) with ESMTPA id 712F8102DB for ; Mon, 1 Oct 2018 16:21:33 -0400 (EDT) From: Peter Eisentraut Subject: settings to control SSL/TLS protocol version Openpgp: preference=signencrypt Autocrypt: addr=peter.eisentraut@2ndquadrant.com; prefer-encrypt=mutual; keydata= xsFNBFUUt6kBEADZd9NNTBJbHmAXXJgPGOdd6Q73l80oifIVgn2tRxP9dYkCfTlo/yLqbKTl JNqTcyM6XrJDnB2sMEUGYCewYZXl+9C4bBJWyNqcEI1ae9u71vEq/fknFLArJ+2wN+f7QuRx Q8d94ZJAiJQ5g3fNk2HVeedCQCKP5dCzU+ZLt2dbsx1PDZLjTO9gf+JswWuGFb5wY5PZVM5V hq66Xk7ZJzHuARacza2RT7J2fkMmQBY+kr7L98Perb0GhafnlhXB0PvUB+N3xpmggMfwuhTu BngS/G/r3GvemxJuFxouw8xsMqrsfdksJXA2gLXYtwRCssdPV3PO0rlD9twqDo8URfIJ5fb6 1g/MV8aTOKjg3Q8MpJPtkwJqN4o3PvbwYdedeFnOVkkYAJdu/aX1v1BeCBDu7Hy3sF52scD3 pQbyQSl9vUDpTLarASAxNbAV0NRJE8dp4vfW6AH1ccryGiFqw/czPK/iN0+MT8wsjAW6WW4w hvjm5UPA1KTwi3ZT8eT5uycuH7QpuNk7LnGGXQ6KaRALFywzkr0A0V0AvFNa+l4wstMaXaB6 dmMXyF0/hfryqyOeu1gAdq4q0/PNC2dPgb/6uoh4eMjN6A5GXcprilhz5DulmsilY21hfSoU S64ODed96pKhprsOxjZiDRsN1QM5MwB+uwVWUNfsX7fIxE0BrwARAQABzSdQZXRlciBFaXNl bnRyYXV0IDxwZXRlckBlaXNlbnRyYXV0Lm9yZz7CwXoEEwEIACQCGwMFCwkIBwMFFQoJCAsF FgIDAQACHgECF4AFAlUUuKQCGQEACgkQoZ8SQ+xBJp8llw//RbGoXnF72FZTlOFsnNyxnWbF vViPCfdAlZl1GGK9OYCvV1dp/956HuhB0wpaGQHiBmQfOPJf/jLOPjXFYm2iEChEycrBChuE j4TSYemMp5BSPILYk9Uwd16kVD/+U6fQfK6H5pOhfBvbM6asMnmpY2wQuvktxHvaGlytFw84 EzFWNZtAZfxkw28w3AhIQkKe9hJanfyDL750RcbyEr8AAHty5IErrvS7tM5vQwIeh5BF26ND CyKPRdZgOgMpcwFfROKBDpAt052CgWIpNdhBdfIKlkCs4/ILxmC3rT/Mb/qZiHcoMMwEu6k+ T7vRAFZZAk62Yrr/U8/vUGKlzRZQoo86fyojCfI0ibCIc0z8rwCVY9P40G9wD9BTCZS/z8Vh jjpBlNnIKw2hM6hbxavKndCJjFFJD08rXrTyrLF/of18xD37vNdYooP9VATB5QjOWFRrscSZ 4a89e+to3m7YVnd4xdXwGp47dYusoax84C8tg1gZrH38ol9dPmnKX6GZrXeS7tH9k8VeUpJ8 HQbRThQRWAT936QpYbLConBmOtmbLmjQOGtiXPo1oK57X/7U/WBja5vWmm2q+Yxtt+3uHGVg DdDU4CJpXo4lX0v2n3QV5EBSW9hjdF3bNfl6GFBb1pPEhqNcMDUc7zkx/2uENdAdk/BnqMgH umip7b0pVfvOwU0EVRS3qQEQAJf6p0P7D+hMYUgCPkvgrcz6OJYsAYdUMUmokfqmkKwK0oJM ew8TNGM53ocKAgQGma5f10rwbZNPlpVPNRX5hwUmwVlcwSut0oE+JfUBH7mpysWvpF05RKIy q9RCoJZrAbXS7Tig56A1QD8IcM00rERZMcCOlI1+q9m4u9AOI+0LyGGSH+VvoyDHD/Jew4R2 TmPEF8Pu7lYiNYK88Q6u0kBkc+Tz3BNlyc6fi3HxnFfp0b75HLXPSTu2SwA/0Q31wHZXwrEU BR9KgSn/qbgy8ydPc97i82fhiFE3cbGexfPrQSMYmDGi+dcQ0s+AMQwC3XyMC0JkHpYUuFkR QdlIvaIhgFUUN2Vr4xF2ADaNTNFc4DYaiPHFAgHZw+3pZWqS4uIiWgJynrEaHw4F3QWU8/JB iyEWDhNq4WBrRA0u914TCCAoFOOKMnRdl8eJrRQKM/5/lXbHFjjlI/LDKhLRFsuQsnJJ3331 RjCzpHPZG5/p5KR1RHiAXa0p/DW5lXyq21hS3kjDlleoHqOxCN/cy0Jgz7qLDq1vZoCl67Sy RAH60c2Xu4may9SVltmot0OzWVHdrfS+85FQGp9580DaeLio7YMFKy2bfEvwQJ/c9xD2QPB+ oSb3V8ueSznXBG5+dyfOsZFRPxceA0wA2rSWZSjxLdKxvyGTj9vsCjaDu13rABEBAAHCwV8E GAEIAAkFAlUUt6kCGwwACgkQoZ8SQ+xBJp+HJhAAxmSTsC5y7p9Zu+nnLpucv/h88oEx985e qWeXzQiwM3pfRZS+PdTH9TyzHK0KOgKoAiubk0vt+BrT91D9d0G5kVQaTctAErGBoMkTaZJT XVEcNphiPzysdSqvprjojMp1y7rG8AP+Xd6m0rE1LRnkRRm8HyI8vdXsuLQPITGWXDLMjaNq AOV3BUnzkgtjMuIYw7SCr+12ZOb5dEKvaG4kjC4kaJ/TLbuBhVANcXkC90yp0AOZLs/cB1Dj OAXno/RUUruJ3r27a+pFv768UAi9QWcdw58yPxreMNMLqAgsS9oTHwHfGNWcB2dJ4UW+GMLJ hTf9TjQ2f+N/sIx5XMQ9pYw6CAJMK29qPx6/ZayrPxf22EXf0D3zTwIEZgwfSkynFVwV25L7 awQq60fifdMYheSxq7GbhpsixmcD+e161cCmLIt75YDt5bQ0B1yf7EmxG8n7pGZAOM6LoNsU fkSldba5XVwh8LuN5mK0nQBELGW6Os4TDq4REggLpfcvFC215zpuo0iCGnmE/Bns4nowqUSP u4tkWL+nxW4qgv8wo8HJ52jd79EJ8iqfIBoidBfy9AIUiEUApGQzWPu6yWcI8fY0rN5D+tc+ Yw1Zt6Mm+huYJpgCRsTcfzEcahnBn521CWcWvhW1ff3KFileFMtNmnBBhMncmRKHphtTKEpN 3jI= To: pgsql-hackers Organization: 2ndQuadrant Message-ID: <1822da87-b862-041a-9fc2-d0310c3da173@2ndquadrant.com> Date: Mon, 1 Oct 2018 22:21:31 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="------------3A7490F1DC1597A87145DDA0" Content-Language: en-US List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk This is a multi-part message in MIME format. --------------3A7490F1DC1597A87145DDA0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit There have been some requests to be able to select the TLS versions PostgreSQL is using. We currently only hardcode that SSLv2 and SSLv3 are disabled, but there is also some interest now in disabling TLSv1.0 and TLSv1.1. Also, I've had some issues in some combinations with the new TLSv1.3, so there is perhaps also some use for disabling at the top end. Attached is a patch that implements this. For example: ssl_min_protocol_version = 'TLSv1' ssl_max_protocol_version = 'any' For reference, here is similar functionality implemented elsewhere: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslprotocol Unlike those two, which offer a list of protocols to use, I have gone with min and max settings. I think that is easier to use, and it also maps better to the newer OpenSSL API (SSL_CTX_set_min_proto_version() etc.). The older SSL_CTX_set_options()-based approach is deprecated and has some very weird behaviors that would make it complicated to use for anything more than a min/max. -- Peter Eisentraut http://www.2ndQuadrant.com/ PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services --------------3A7490F1DC1597A87145DDA0 Content-Type: text/plain; charset=UTF-8; x-mac-type="0"; x-mac-creator="0"; name="0001-Add-settings-to-control-SSL-TLS-protocol-version.patch" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename*0="0001-Add-settings-to-control-SSL-TLS-protocol-version.patch" RnJvbSA3NjhjY2Y4NjFiNjkwNGJhYTI1YTYwMWEwOWM1ZTQ0MGYzZjYyY2NhIE1vbiBTZXAg MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBQZXRlciBFaXNlbnRyYXV0IDxwZXRlcl9lQGdteC5u ZXQ+CkRhdGU6IE1vbiwgMSBPY3QgMjAxOCAyMTo0MzozMCArMDIwMApTdWJqZWN0OiBbUEFU Q0hdIEFkZCBzZXR0aW5ncyB0byBjb250cm9sIFNTTC9UTFMgcHJvdG9jb2wgdmVyc2lvbgoK Rm9yIGV4YW1wbGU6CgogICAgc3NsX21pbl9wcm90b2NvbF92ZXJzaW9uID0gJ1RMU3YxJwog ICAgc3NsX21heF9wcm90b2NvbF92ZXJzaW9uID0gJ2FueScKLS0tCiBkb2Mvc3JjL3NnbWwv Y29uZmlnLnNnbWwgICAgICAgICAgICAgICAgICAgICAgfCAgNDQgKysrKysrKwogc3JjL2Jh Y2tlbmQvbGlicHEvYmUtc2VjdXJlLW9wZW5zc2wuYyAgICAgICAgIHwgMTIzICsrKysrKysr KysrKysrKysrLQogc3JjL2JhY2tlbmQvbGlicHEvYmUtc2VjdXJlLmMgICAgICAgICAgICAg ICAgIHwgICAzICsKIHNyYy9iYWNrZW5kL3V0aWxzL21pc2MvZ3VjLmMgICAgICAgICAgICAg ICAgICB8ICAzMyArKysrKwogc3JjL2JhY2tlbmQvdXRpbHMvbWlzYy9wb3N0Z3Jlc3FsLmNv bmYuc2FtcGxlIHwgICAyICsKIHNyYy9pbmNsdWRlL2xpYnBxL2xpYnBxLmggICAgICAgICAg ICAgICAgICAgICB8ICAxMSArKwogNiBmaWxlcyBjaGFuZ2VkLCAyMTQgaW5zZXJ0aW9ucygr KSwgMiBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9kb2Mvc3JjL3NnbWwvY29uZmlnLnNn bWwgYi9kb2Mvc3JjL3NnbWwvY29uZmlnLnNnbWwKaW5kZXggZjExYjhmNzI0Yy4uZWZkZjhh Mjg0OSAxMDA2NDQKLS0tIGEvZG9jL3NyYy9zZ21sL2NvbmZpZy5zZ21sCisrKyBiL2RvYy9z cmMvc2dtbC9jb25maWcuc2dtbApAQCAtMTI5MCw2ICsxMjkwLDUwIEBAIDx0aXRsZT5TU0w8 L3RpdGxlPgogICAgICAgPC9saXN0aXRlbT4KICAgICAgPC92YXJsaXN0ZW50cnk+CiAKKyAg ICAgPHZhcmxpc3RlbnRyeSBpZD0iZ3VjLXNzbC1taW4tcHJvdG9jb2wtdmVyc2lvbiIgeHJl ZmxhYmVsPSJzc2xfbWluX3Byb3RvY29sX3ZlcnNpb24iPgorICAgICAgPHRlcm0+PHZhcm5h bWU+c3NsX21pbl9wcm90b2NvbF92ZXJzaW9uPC92YXJuYW1lPiAoPHR5cGU+ZW51bTwvdHlw ZT4pCisgICAgICA8aW5kZXh0ZXJtPgorICAgICAgIDxwcmltYXJ5Pjx2YXJuYW1lPnNzbF9t aW5fcHJvdG9jb2xfdmVyc2lvbjwvdmFybmFtZT4gY29uZmlndXJhdGlvbiBwYXJhbWV0ZXI8 L3ByaW1hcnk+CisgICAgICA8L2luZGV4dGVybT4KKyAgICAgIDwvdGVybT4KKyAgICAgIDxs aXN0aXRlbT4KKyAgICAgICA8cGFyYT4KKyAgICAgICAgU2V0cyB0aGUgbWluaW11bSBTU0wv VExTIHByb3RvY29sIHZlcnNpb24gdG8gdXNlLiAgVmFsaWQgdmFsdWVzIGFyZQorICAgICAg ICBjdXJyZW50bHk6IDxsaXRlcmFsPlRMU3YxPC9saXRlcmFsPiwgPGxpdGVyYWw+VExTdjEu MTwvbGl0ZXJhbD4sCisgICAgICAgIDxsaXRlcmFsPlRMU3YxLjI8L2xpdGVyYWw+LCA8bGl0 ZXJhbD5UTFN2MS4zPC9saXRlcmFsPi4gIE9sZGVyCisgICAgICAgIHZlcnNpb25zIG9mIHRo ZSA8cHJvZHVjdG5hbWU+T3BlblNTTDwvcHJvZHVjdG5hbWU+IGxpYnJhcnkgZG8gbm90Cisg ICAgICAgIHN1cHBvcnQgYWxsIHZhbHVlcy4gIEFuIGVycm9yIHdpbGwgYmUgcmFpc2VkIGlm IGFuIHVuc3VwcG9ydGVkIHNldHRpbmcKKyAgICAgICAgaXMgY2hvc2VuLiAgUHJvdG9jb2wg dmVyc2lvbnMgYmVmb3JlIFRMUyAxLjAsIG5hbWVseSBTU0wgdmVyc2lvbiAyIGFuZAorICAg ICAgICAzLCBhcmUgYWx3YXlzIGRpc2FibGVkLgorICAgICAgIDwvcGFyYT4KKworICAgICAg IDxwYXJhPgorICAgICAgICBUaGUgZGVmYXVsdCBpcyA8bGl0ZXJhbD5UTFN2MTwvbGl0ZXJh bD4sIG1haW5seSB0byBzdXBwb3J0IG9sZGVyCisgICAgICAgIHZlcnNpb25zIG9mIHRoZSA8 cHJvZHVjdG5hbWU+T3BlblNTTDwvcHJvZHVjdG5hbWU+IGxpYnJhcnkuICBZb3UgbWlnaHQK KyAgICAgICAgd2FudCB0byBzZXQgdGhpcyB0byBhIGhpZ2hlciB2YWx1ZSBpZiBhbGwgc29m dHdhcmUgY29tcG9uZW50cyBjYW4KKyAgICAgICAgc3VwcG9ydCB0aGUgbmV3ZXIgcHJvdG9j b2wgdmVyc2lvbnMuCisgICAgICAgPC9wYXJhPgorICAgICAgPC9saXN0aXRlbT4KKyAgICAg PC92YXJsaXN0ZW50cnk+CisKKyAgICAgPHZhcmxpc3RlbnRyeSBpZD0iZ3VjLXNzbC1tYXgt cHJvdG9jb2wtdmVyc2lvbiIgeHJlZmxhYmVsPSJzc2xfbWF4X3Byb3RvY29sX3ZlcnNpb24i PgorICAgICAgPHRlcm0+PHZhcm5hbWU+c3NsX21heF9wcm90b2NvbF92ZXJzaW9uPC92YXJu YW1lPiAoPHR5cGU+ZW51bTwvdHlwZT4pCisgICAgICA8aW5kZXh0ZXJtPgorICAgICAgIDxw cmltYXJ5Pjx2YXJuYW1lPnNzbF9tYXhfcHJvdG9jb2xfdmVyc2lvbjwvdmFybmFtZT4gY29u ZmlndXJhdGlvbiBwYXJhbWV0ZXI8L3ByaW1hcnk+CisgICAgICA8L2luZGV4dGVybT4KKyAg ICAgIDwvdGVybT4KKyAgICAgIDxsaXN0aXRlbT4KKyAgICAgICA8cGFyYT4KKyAgICAgICAg U2V0cyB0aGUgbWF4aW11bSBTU0wvVExTIHByb3RvY29sIHZlcnNpb24gdG8gdXNlLiAgVmFs aWQgdmFsdWVzIGFyZSBhcworICAgICAgICBmb3IgPHhyZWYgbGlua2VuZD0iZ3VjLXNzbC1t aW4tcHJvdG9jb2wtdmVyc2lvbiIvPiwgd2l0aCBhZGRpdGlvbiBvZgorICAgICAgICA8bGl0 ZXJhbD5hbnk8L2xpdGVyYWw+IHdoaWNoIGFsbG93cyBhbnkgcHJvdG9jb2wgdmVyc2lvbi4g IFRoZSBkZWZhdWx0IGlzCisgICAgICAgIDxsaXRlcmFsPmFueTwvbGl0ZXJhbD4uICBTZXR0 aW5nIHRoZSBtYXhpbXVtIHByb3RvY29sIHZlcnNpb24gaXMKKyAgICAgICAgbWFpbmx5IHVz ZWZ1bCBmb3IgdGVzdGluZyBvciBpZiBzb21lIGNvbXBvbmVudCBoYXMgaXNzdWVzIHdvcmtp bmcgd2l0aAorICAgICAgICBhIG5ld2VyIHByb3RvY29sLgorICAgICAgIDwvcGFyYT4KKyAg ICAgIDwvbGlzdGl0ZW0+CisgICAgIDwvdmFybGlzdGVudHJ5PgorCiAgICAgIDx2YXJsaXN0 ZW50cnkgaWQ9Imd1Yy1zc2wtZGgtcGFyYW1zLWZpbGUiIHhyZWZsYWJlbD0ic3NsX2RoX3Bh cmFtc19maWxlIj4KICAgICAgIDx0ZXJtPjx2YXJuYW1lPnNzbF9kaF9wYXJhbXNfZmlsZTwv dmFybmFtZT4gKDx0eXBlPnN0cmluZzwvdHlwZT4pCiAgICAgICA8aW5kZXh0ZXJtPgpkaWZm IC0tZ2l0IGEvc3JjL2JhY2tlbmQvbGlicHEvYmUtc2VjdXJlLW9wZW5zc2wuYyBiL3NyYy9i YWNrZW5kL2xpYnBxL2JlLXNlY3VyZS1vcGVuc3NsLmMKaW5kZXggNmE1NzY1NzJiYi4uYjJi MGNjY2RhZSAxMDA2NDQKLS0tIGEvc3JjL2JhY2tlbmQvbGlicHEvYmUtc2VjdXJlLW9wZW5z c2wuYworKysgYi9zcmMvYmFja2VuZC9saWJwcS9iZS1zZWN1cmUtb3BlbnNzbC5jCkBAIC02 Nyw2ICs2NywxMiBAQCBzdGF0aWMgYm9vbCBTU0xfaW5pdGlhbGl6ZWQgPSBmYWxzZTsKIHN0 YXRpYyBib29sIGR1bW15X3NzbF9wYXNzd2RfY2JfY2FsbGVkID0gZmFsc2U7CiBzdGF0aWMg Ym9vbCBzc2xfaXNfc2VydmVyX3N0YXJ0OwogCitzdGF0aWMgaW50IHNzbF9wcm90b2NvbF92 ZXJzaW9uX3RvX29wZW5zc2woaW50IHYsIGNvbnN0IGNoYXIgKmd1Y19uYW1lKTsKKyNpZiAo T1BFTlNTTF9WRVJTSU9OX05VTUJFUiA8IDB4MTAxMDAwMDBMKQorc3RhdGljIGludCBTU0xf Q1RYX3NldF9taW5fcHJvdG9fdmVyc2lvbihTU0xfQ1RYICpjdHgsIGludCB2ZXJzaW9uKTsK K3N0YXRpYyBpbnQgU1NMX0NUWF9zZXRfbWF4X3Byb3RvX3ZlcnNpb24oU1NMX0NUWCAqY3R4 LCBpbnQgdmVyc2lvbik7CisjZW5kaWYKKwogCiAvKiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0gKi8KIC8qCQkJCQkJIFB1 YmxpYyBpbnRlcmZhY2UJCQkJCQkqLwpAQCAtMTgzLDggKzE4OSwxNCBAQCBiZV90bHNfaW5p dChib29sIGlzU2VydmVyU3RhcnQpCiAJCWdvdG8gZXJyb3I7CiAJfQogCi0JLyogZGlzYWxs b3cgU1NMIHYyL3YzICovCi0JU1NMX0NUWF9zZXRfb3B0aW9ucyhjb250ZXh0LCBTU0xfT1Bf Tk9fU1NMdjIgfCBTU0xfT1BfTk9fU1NMdjMpOworCWlmIChzc2xfbWluX3Byb3RvY29sX3Zl cnNpb24pCisJCVNTTF9DVFhfc2V0X21pbl9wcm90b192ZXJzaW9uKGNvbnRleHQsCisJCQkJ CQkJCQkgIHNzbF9wcm90b2NvbF92ZXJzaW9uX3RvX29wZW5zc2woc3NsX21pbl9wcm90b2Nv bF92ZXJzaW9uLAorCQkJCQkJCQkJCQkJCQkJCQkgICJzc2xfbWluX3Byb3RvY29sX3ZlcnNp b24iKSk7CisJaWYgKHNzbF9tYXhfcHJvdG9jb2xfdmVyc2lvbikKKwkJU1NMX0NUWF9zZXRf bWF4X3Byb3RvX3ZlcnNpb24oY29udGV4dCwKKwkJCQkJCQkJCSAgc3NsX3Byb3RvY29sX3Zl cnNpb25fdG9fb3BlbnNzbChzc2xfbWF4X3Byb3RvY29sX3ZlcnNpb24sCisJCQkJCQkJCQkJ CQkJCQkJCSAgInNzbF9tYXhfcHJvdG9jb2xfdmVyc2lvbiIpKTsKIAogCS8qIGRpc2FsbG93 IFNTTCBzZXNzaW9uIHRpY2tldHMgKi8KICNpZmRlZiBTU0xfT1BfTk9fVElDS0VUCQkJLyog YWRkZWQgaW4gT3BlblNTTCAwLjkuOGYgKi8KQEAgLTEyMDksMyArMTIyMSwxMTAgQEAgWDUw OV9OQU1FX3RvX2NzdHJpbmcoWDUwOV9OQU1FICpuYW1lKQogCiAJcmV0dXJuIHJlc3VsdDsK IH0KKworLyoKKyAqIENvbnZlcnQgVExTIHByb3RvY29sIHZlcnNpb24gR1VDIGVudW0gdG8g T3BlblNTTCB2YWx1ZXMKKyAqCisgKiBUaGlzIGlzIGEgc3RyYWlnaHRmb3J3YXJkIG9uZS10 by1vbmUgbWFwcGluZywgYnV0IGRvaW5nIGl0IHRoaXMgd2F5IG1ha2VzCisgKiBndWMuYyBp bmRlcGVuZGVudCBvZiBPcGVuU1NMIGF2YWlsYWJpbGl0eSBhbmQgdmVyc2lvbi4KKyAqCisg KiBJZiBhIHZlcnNpb24gaXMgcGFzc2VkIHRoYXQgaXMgbm90IHN1cHBvcnRlZCBieSB0aGUg Y3VycmVudCBPcGVuU1NMCisgKiB2ZXJzaW9uLCB0aGVuIHdlIHRocm93IGFuIGVycm9yLCBz byB0aGF0IHN1YnNlcXVlbnQgY29kZSBjYW4gYXNzdW1lIGl0J3MKKyAqIHdvcmtpbmcgd2l0 aCBhIHN1cHBvcnRlZCB2ZXJzaW9uLgorICovCitzdGF0aWMgaW50Citzc2xfcHJvdG9jb2xf dmVyc2lvbl90b19vcGVuc3NsKGludCB2LCBjb25zdCBjaGFyICpndWNfbmFtZSkKK3sKKwlz d2l0Y2ggKHYpCisJeworCQljYXNlIFBHX1RMU19BTlk6CisJCQlyZXR1cm4gMDsKKwkJY2Fz ZSBQR19UTFMxX1ZFUlNJT046CisJCQlyZXR1cm4gVExTMV9WRVJTSU9OOworCQljYXNlIFBH X1RMUzFfMV9WRVJTSU9OOgorI2lmZGVmIFRMUzFfMV9WRVJTSU9OCisJCQlyZXR1cm4gVExT MV8xX1ZFUlNJT047CisjZWxzZQorCQkJZ290byBlcnJvcjsKKyNlbmRpZgorCQljYXNlIFBH X1RMUzFfMl9WRVJTSU9OOgorI2lmZGVmIFRMUzFfMl9WRVJTSU9OCisJCQlyZXR1cm4gVExT MV8yX1ZFUlNJT047CisjZWxzZQorCQkJZ290byBlcnJvcjsKKyNlbmRpZgorCQljYXNlIFBH X1RMUzFfM19WRVJTSU9OOgorI2lmZGVmIFRMUzFfM19WRVJTSU9OCisJCQlyZXR1cm4gVExT MV8zX1ZFUlNJT047CisjZWxzZQorCQkJZ290byBlcnJvcjsKKyNlbmRpZgorCX0KKworZXJy b3I6CisJcGdfYXR0cmlidXRlX3VudXNlZCgpOworCWVyZXBvcnQoRVJST1IsCisJCQkoZXJy bXNnKCIlcyBzZXR0aW5nICVzIG5vdCBzdXBwb3J0ZWQgYnkgdGhpcyBidWlsZCIsCisJCQkJ CWd1Y19uYW1lLAorCQkJCQlHZXRDb25maWdPcHRpb24oZ3VjX25hbWUsIGZhbHNlLCBmYWxz ZSkpKSk7CisJcmV0dXJuIC0xOworfQorCisvKgorICogUmVwbGFjZW1lbnRzIGZvciBBUElz IHByZXNlbnQgaW4gbmV3ZXIgdmVyc2lvbnMgb2YgT3BlblNTTAorICovCisjaWYgKE9QRU5T U0xfVkVSU0lPTl9OVU1CRVIgPCAweDEwMTAwMDAwTCkKKworLyoKKyAqIE9wZW5TU0wgdmVy c2lvbnMgdGhhdCBzdXBwb3J0IFRMUyAxLjMgc2hvdWxkbid0IGdldCBoZXJlIGJlY2F1c2Ug dGhleQorICogYWxyZWFkeSBoYXZlIHRoZXNlIGZ1bmN0aW9ucy4gIFNvIHdlIGRvbid0IGhh dmUgdG8ga2VlcCB1cGRhdGluZyB0aGUgYmVsb3cKKyAqIGNvZGUgZm9yIGV2ZXJ5IG5ldyBU TFMgdmVyc2lvbiwgYW5kIGV2ZW50dWFsbHkgaXQgY2FuIGdvIGF3YXkuICBCdXQgbGV0J3MK KyAqIGp1c3QgY2hlY2sgdGhpcyB0byBtYWtlIHN1cmUgLi4uCisgKi8KKyNpZmRlZiBUTFMx XzNfVkVSU0lPTgorI2Vycm9yIE9wZW5TU0wgdmVyc2lvbiBtaXNtYXRjaAorI2VuZGlmCisK K3N0YXRpYyBpbnQKK1NTTF9DVFhfc2V0X21pbl9wcm90b192ZXJzaW9uKFNTTF9DVFggKmN0 eCwgaW50IHZlcnNpb24pCit7CisJaW50CQkJc3NsX29wdGlvbnMgPSBTU0xfT1BfTk9fU1NM djIgfCBTU0xfT1BfTk9fU1NMdjM7CisKKwlpZiAodmVyc2lvbiA+IFRMUzFfVkVSU0lPTikK KwkJc3NsX29wdGlvbnMgfD0gU1NMX09QX05PX1RMU3YxOworI2lmZGVmIFRMUzFfMV9WRVJT SU9OCisJaWYgKHZlcnNpb24gPiBUTFMxXzFfVkVSU0lPTikKKwkJc3NsX29wdGlvbnMgfD0g U1NMX09QX05PX1RMU3YxXzE7CisjZW5kaWYKKyNpZmRlZiBUTFMxXzJfVkVSU0lPTgorCWlm ICh2ZXJzaW9uID4gVExTMV8yX1ZFUlNJT04pCisJCXNzbF9vcHRpb25zIHw9IFNTTF9PUF9O T19UTFN2MV8yOworI2VuZGlmCisKKwlTU0xfQ1RYX3NldF9vcHRpb25zKGN0eCwgc3NsX29w dGlvbnMpOworCisJcmV0dXJuIDE7CQkJCQkvKiBzdWNjZXNzICovCit9CisKK3N0YXRpYyBp bnQKK1NTTF9DVFhfc2V0X21heF9wcm90b192ZXJzaW9uKFNTTF9DVFggKmN0eCwgaW50IHZl cnNpb24pCit7CisJaW50CQkJc3NsX29wdGlvbnMgPSAwOworCisJQXNzZXJ0QXJnKHZlcnNp b24gIT0gMCk7CisKKyNpZmRlZiBUTFMxXzFfVkVSU0lPTgorCWlmICh2ZXJzaW9uIDwgVExT MV8xX1ZFUlNJT04pCisJCXNzbF9vcHRpb25zIHw9IFNTTF9PUF9OT19UTFN2MV8xOworI2Vu ZGlmCisjaWZkZWYgVExTMV8yX1ZFUlNJT04KKwlpZiAodmVyc2lvbiA8IFRMUzFfMl9WRVJT SU9OKQorCQlzc2xfb3B0aW9ucyB8PSBTU0xfT1BfTk9fVExTdjFfMjsKKyNlbmRpZgorCisJ U1NMX0NUWF9zZXRfb3B0aW9ucyhjdHgsIHNzbF9vcHRpb25zKTsKKworCXJldHVybiAxOwkJ CQkJLyogc3VjY2VzcyAqLworfQorCisjZW5kaWYJCQkJCQkJLyogT1BFTlNTTF9WRVJTSU9O X05VTUJFUiAqLwpkaWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQvbGlicHEvYmUtc2VjdXJlLmMg Yi9zcmMvYmFja2VuZC9saWJwcS9iZS1zZWN1cmUuYwppbmRleCBkMzQ5ZDdjMmM3Li4wY2Y5 N2NiOWIwIDEwMDY0NAotLS0gYS9zcmMvYmFja2VuZC9saWJwcS9iZS1zZWN1cmUuYworKysg Yi9zcmMvYmFja2VuZC9saWJwcS9iZS1zZWN1cmUuYwpAQCAtNjAsNiArNjAsOSBAQCBjaGFy CSAgICpTU0xFQ0RIQ3VydmU7CiAvKiBHVUMgdmFyaWFibGU6IGlmIGZhbHNlLCBwcmVmZXIg Y2xpZW50IGNpcGhlcnMgKi8KIGJvb2wJCVNTTFByZWZlclNlcnZlckNpcGhlcnM7CiAKK2lu dAkJCXNzbF9taW5fcHJvdG9jb2xfdmVyc2lvbjsKK2ludAkJCXNzbF9tYXhfcHJvdG9jb2xf dmVyc2lvbjsKKwogLyogLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tICovCiAvKgkJCSBQcm9jZWR1cmVzIGNvbW1vbiB0byBh bGwgc2VjdXJlIHNlc3Npb25zCQkJKi8KIC8qIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSAqLwpkaWZmIC0tZ2l0IGEvc3Jj L2JhY2tlbmQvdXRpbHMvbWlzYy9ndWMuYyBiL3NyYy9iYWNrZW5kL3V0aWxzL21pc2MvZ3Vj LmMKaW5kZXggMGJlYzM5MTRmOC4uNDNkNGVmYWFhZSAxMDA2NDQKLS0tIGEvc3JjL2JhY2tl bmQvdXRpbHMvbWlzYy9ndWMuYworKysgYi9zcmMvYmFja2VuZC91dGlscy9taXNjL2d1Yy5j CkBAIC00MjksNiArNDI5LDE1IEBAIHN0YXRpYyBjb25zdCBzdHJ1Y3QgY29uZmlnX2VudW1f ZW50cnkgcGFzc3dvcmRfZW5jcnlwdGlvbl9vcHRpb25zW10gPSB7CiAJe05VTEwsIDAsIGZh bHNlfQogfTsKIAorY29uc3Qgc3RydWN0IGNvbmZpZ19lbnVtX2VudHJ5IHNzbF9wcm90b2Nv bF92ZXJzaW9uc19pbmZvW10gPSB7CisJeyJhbnkiLCBQR19UTFNfQU5ZLCBmYWxzZX0sCisJ eyJUTFN2MSIsIFBHX1RMUzFfVkVSU0lPTiwgZmFsc2V9LAorCXsiVExTdjEuMSIsIFBHX1RM UzFfMV9WRVJTSU9OLCBmYWxzZX0sCisJeyJUTFN2MS4yIiwgUEdfVExTMV8yX1ZFUlNJT04s IGZhbHNlfSwKKwl7IlRMU3YxLjMiLCBQR19UTFMxXzNfVkVSU0lPTiwgZmFsc2V9LAorCXtO VUxMLCAwLCBmYWxzZX0KK307CisKIC8qCiAgKiBPcHRpb25zIGZvciBlbnVtIHZhbHVlcyBz dG9yZWQgaW4gb3RoZXIgbW9kdWxlcwogICovCkBAIC00MTg3LDYgKzQxOTYsMzAgQEAgc3Rh dGljIHN0cnVjdCBjb25maWdfZW51bSBDb25maWd1cmVOYW1lc0VudW1bXSA9CiAJCU5VTEws IE5VTEwsIE5VTEwKIAl9LAogCisJeworCQl7InNzbF9taW5fcHJvdG9jb2xfdmVyc2lvbiIs IFBHQ19TSUdIVVAsIENPTk5fQVVUSF9TU0wsCisJCQlnZXR0ZXh0X25vb3AoIlNldHMgdGhl IG1pbmltdW0gU1NML1RMUyBwcm90b2NvbCB2ZXJzaW9uIHRvIHVzZS4iKSwKKwkJCU5VTEws CisJCQlHVUNfU1VQRVJVU0VSX09OTFkKKwkJfSwKKwkJJnNzbF9taW5fcHJvdG9jb2xfdmVy c2lvbiwKKwkJUEdfVExTMV9WRVJTSU9OLAorCQlzc2xfcHJvdG9jb2xfdmVyc2lvbnNfaW5m byArIDEgLyogZG9uJ3QgYWxsb3cgJ2FueScgKi8sCisJCU5VTEwsIE5VTEwsIE5VTEwKKwl9 LAorCisJeworCQl7InNzbF9tYXhfcHJvdG9jb2xfdmVyc2lvbiIsIFBHQ19TSUdIVVAsIENP Tk5fQVVUSF9TU0wsCisJCQlnZXR0ZXh0X25vb3AoIlNldHMgdGhlIG1heGltdW0gU1NML1RM UyBwcm90b2NvbCB2ZXJzaW9uIHRvIHVzZS4iKSwKKwkJCU5VTEwsCisJCQlHVUNfU1VQRVJV U0VSX09OTFkKKwkJfSwKKwkJJnNzbF9tYXhfcHJvdG9jb2xfdmVyc2lvbiwKKwkJUEdfVExT X0FOWSwKKwkJc3NsX3Byb3RvY29sX3ZlcnNpb25zX2luZm8sCisJCU5VTEwsIE5VTEwsIE5V TEwKKwl9LAorCiAJLyogRW5kLW9mLWxpc3QgbWFya2VyICovCiAJewogCQl7TlVMTCwgMCwg MCwgTlVMTCwgTlVMTH0sIE5VTEwsIDAsIE5VTEwsIE5VTEwsIE5VTEwsIE5VTEwKZGlmZiAt LWdpdCBhL3NyYy9iYWNrZW5kL3V0aWxzL21pc2MvcG9zdGdyZXNxbC5jb25mLnNhbXBsZSBi L3NyYy9iYWNrZW5kL3V0aWxzL21pc2MvcG9zdGdyZXNxbC5jb25mLnNhbXBsZQppbmRleCA0 ZTYxYmM2NTIxLi4xZTcxZTcxOTZkIDEwMDY0NAotLS0gYS9zcmMvYmFja2VuZC91dGlscy9t aXNjL3Bvc3RncmVzcWwuY29uZi5zYW1wbGUKKysrIGIvc3JjL2JhY2tlbmQvdXRpbHMvbWlz Yy9wb3N0Z3Jlc3FsLmNvbmYuc2FtcGxlCkBAIC0xMDMsNiArMTAzLDggQEAKICNzc2xfY2lw aGVycyA9ICdISUdIOk1FRElVTTorM0RFUzohYU5VTEwnICMgYWxsb3dlZCBTU0wgY2lwaGVy cwogI3NzbF9wcmVmZXJfc2VydmVyX2NpcGhlcnMgPSBvbgogI3NzbF9lY2RoX2N1cnZlID0g J3ByaW1lMjU2djEnCisjc3NsX21pbl9wcm90b2NvbF92ZXJzaW9uID0gJ1RMU3YxJworI3Nz bF9tYXhfcHJvdG9jb2xfdmVyc2lvbiA9ICdhbnknCiAjc3NsX2RoX3BhcmFtc19maWxlID0g JycKICNzc2xfcGFzc3BocmFzZV9jb21tYW5kID0gJycKICNzc2xfcGFzc3BocmFzZV9jb21t YW5kX3N1cHBvcnRzX3JlbG9hZCA9IG9mZgpkaWZmIC0tZ2l0IGEvc3JjL2luY2x1ZGUvbGli cHEvbGlicHEuaCBiL3NyYy9pbmNsdWRlL2xpYnBxL2xpYnBxLmgKaW5kZXggMzZiYWY2Yjkx OS4uZDNhMTIzNThjYSAxMDA2NDQKLS0tIGEvc3JjL2luY2x1ZGUvbGlicHEvbGlicHEuaAor KysgYi9zcmMvaW5jbHVkZS9saWJwcS9saWJwcS5oCkBAIC0xMDIsNiArMTAyLDE3IEBAIGV4 dGVybiBXYWl0RXZlbnRTZXQgKkZlQmVXYWl0U2V0OwogZXh0ZXJuIGNoYXIgKlNTTENpcGhl clN1aXRlczsKIGV4dGVybiBjaGFyICpTU0xFQ0RIQ3VydmU7CiBleHRlcm4gYm9vbCBTU0xQ cmVmZXJTZXJ2ZXJDaXBoZXJzOworZXh0ZXJuIGludAlzc2xfbWluX3Byb3RvY29sX3ZlcnNp b247CitleHRlcm4gaW50CXNzbF9tYXhfcHJvdG9jb2xfdmVyc2lvbjsKKworZW51bSBzc2xf cHJvdG9jb2xfdmVyc2lvbnMKK3sKKwlQR19UTFNfQU5ZID0gMCwKKwlQR19UTFMxX1ZFUlNJ T04sCisJUEdfVExTMV8xX1ZFUlNJT04sCisJUEdfVExTMV8yX1ZFUlNJT04sCisJUEdfVExT MV8zX1ZFUlNJT04KK307CiAKIC8qCiAgKiBwcm90b3R5cGVzIGZvciBmdW5jdGlvbnMgaW4g YmUtc2VjdXJlLWNvbW1vbi5jCi0tIAoyLjE5LjAKCg== --------------3A7490F1DC1597A87145DDA0--