Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kekpC-0006QW-4b for pgsql-hackers@arkaria.postgresql.org; Mon, 16 Nov 2020 20:10:06 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kekgO-0001C7-IU for pgsql-hackers@arkaria.postgresql.org; Mon, 16 Nov 2020 20:01:00 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kekgO-0001C0-0D for pgsql-hackers@lists.postgresql.org; Mon, 16 Nov 2020 20:01:00 +0000 Received: from mail-dm6nam10on2089.outbound.protection.outlook.com ([40.107.93.89] helo=NAM10-DM6-obe.outbound.protection.outlook.com) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kekgF-0005jU-Js for pgsql-hackers@lists.postgresql.org; Mon, 16 Nov 2020 20:00:58 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=iGJTEoZhR+51fFc/uAKTinyXe0hfCbuxTK5uHsyUoz46M0rjQUJSS9abNjKtZAq041hbF+N2jdmJVGs2L03s3uOu7tARPtO0fH/2z6IOvZJPvPlazjj4RI3FH5xg4UqO4s4XVY7zyRnvg+3DuPpTGR9OBgtYc1ZhkKzWdrZngJ4piJAm+a2ZdqEkLkcKwUEL7GDmad4JJo2Jm9Fvn6ZKkWHZH1sFL1+1rEA5WvOpAJfncuwa8OzTUO3C77nd4lbeCeEegDzw65Ao0YiGyGoECrpBlKXZ7HCoS0EoscOi+I4UwbWQp6CJYH4pYVAsZ4sEhGT11yR4UKcSUgMO6QHaUg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=p5LCDsUWdfdh+t9uZHmzGmMR6ed8eQGQ01h8H4eCTjA=; b=dGs14RJI4fFTIsMsbOiY+QIznx2xqovai/n2v3iYvtLu21AJjhDVlsJfA++TM/OKqtmDyrtGSOUK7ktYcJcXtOjGtyWAsctEOcAVTfB/yxysZ7XdJE5u8qdhdvI0D2mGJZ7yEbDpYud8onEFjLNXIXSQy9FF1JiCvh0byvvj0z0RffXiBr3ZtfdV8UTrSXOsVkryqz5wsObTfLTJXvZjpBJSYsrw7SQLMpRJbZWqBFl6Tcc8AVbHdyQFPtFyGcGJhQ2CXsd4Muug/+JE9DOULaGCGcHUDVJ54JbJn7hRI9wjthzYZVLF8F6aRZB1gL8ZpZj7vwuog/CZFt9i5ouYqw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=vmware.com; dmarc=pass action=none header.from=vmware.com; dkim=pass header.d=vmware.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vmware.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=p5LCDsUWdfdh+t9uZHmzGmMR6ed8eQGQ01h8H4eCTjA=; b=nD9vLFw2TTDSnm3mtA6d36+C973Qj4GwXDrITZNYrYIziaHi8etK/CrPtGHrVzffyqLPeGFsQrygFtjNOvmXlcKwMU241InFGwZudAuytuy+dBvV/L0/R0WMu5EYQuvfV0EwgseKCuVfj5lCnxj38M4ibP2hODjfCs0ac47+ogk= Received: from MWHPR05MB2957.namprd05.prod.outlook.com (2603:10b6:300:60::11) by MWHPR05MB3536.namprd05.prod.outlook.com (2603:10b6:301:46::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3589.12; Mon, 16 Nov 2020 20:00:47 +0000 Received: from MWHPR05MB2957.namprd05.prod.outlook.com ([fe80::e1c8:9250:a1ac:64c6]) by MWHPR05MB2957.namprd05.prod.outlook.com ([fe80::e1c8:9250:a1ac:64c6%7]) with mapi id 15.20.3564.025; Mon, 16 Nov 2020 20:00:47 +0000 From: Jacob Champion To: Daniel Gustafsson CC: Heikki Linnakangas , Andres Freund , Postgres hackers , Michael Paquier , Andrew Dunstan , Stephen Frost , Thomas Munro Subject: Re: Support for NSS as a libpq TLS backend Thread-Topic: Support for NSS as a libpq TLS backend Thread-Index: AQHWM1w61GrKUIsl6UCBcYrYNRBt46kJRsIAgAA+PQCAGQsiAIAEdGUAgAAqk4CAAbpsAIABgI0AgCnqVACAA5UBgIAAY+MAgBTX7ACAACGAAIASngCAgAAfeICABYLFgIAbyjgAgABy24CACw63gIAAAzWAgAwa5QCAA6HPgIAAKuGAgAYXDoCAACZBAIABTCSAgAALLgCAAcj/gIAA61UAgAU5IwA= Date: Mon, 16 Nov 2020 20:00:47 +0000 Message-ID: <5F24348B-10BA-4AA1-999B-1E2AB22B4997@vmware.com> References: <20200904012334.GF19499@paquier.xyz> <20200917074134.GX2873@paquier.xyz> <20200929055939.GF7117@paquier.xyz> <411593A7-E037-474D-BFD7-D3D6683C1D46@yesql.se> <20201020191529.5yverw3ybaube3pg@alap3.anarazel.de> <907FA7D1-9BD9-464B-A6EC-DEEB53438D36@yesql.se> <7ed636a0-872c-3ea7-dc44-b35dd515bb87@iki.fi> <02260088-E0C9-49A2-ACD3-CE51D65A84E3@yesql.se> <0E64F3CB-4731-4FA8-82D8-D8590086654C@vmware.com> <1B0B31E4-AD37-475C-9374-7E24AA808479@vmware.com> <5C27CF6F-5BD3-4639-AAA6-73465595B6DF@vmware.com> <7B5A88DF-863A-4B00-B841-0285C1FF70DF@yesql.se> In-Reply-To: <7B5A88DF-863A-4B00-B841-0285C1FF70DF@yesql.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3445.104.17) authentication-results: yesql.se; dkim=none (message not signed) header.d=none;yesql.se; dmarc=none action=none header.from=vmware.com; x-originating-ip: [50.39.198.229] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 3f3e365c-fb9d-47a1-7976-08d88a6a4f26 x-ms-traffictypediagnostic: MWHPR05MB3536: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:4941; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: l8ywapWQW6MdfbNvHUJf4VdAkk5K4sorNKG8YKPnVIAUNFI2jumG6hi9+bW9bcquOrKjWPRGFdnG3pPtf1q6OZYKhpi0bLwwWcLK9dl0j0tZ9v7MxaA16iXXsKnOzyjQWUNVjDSR+0sZusKj9SoGMu/Z0N/EqvxzWE/vlKPVA1BAOFDgAeTkoFIL7zGPH4s75F+u9OzmzVJxVZzPuuyuhanmNSR49Lrc6T5Q8DDspqYD4B3aMElHY/RsJOKRky0zkUg1gh9MF7/8ldBkB0RBH1a8ZQJenHdJDPGNw8pnk6sIv2JaK7Bj1ZClI+1IaVIx9xqpthztge3TUayB7SDDa9UIuOzjJFpl1jqB30zBqS8MAdCjURyQikI7eaq4wYqauhPYborRKMkSJpXyVJx0yQ== x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MWHPR05MB2957.namprd05.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(136003)(396003)(376002)(39860400002)(346002)(366004)(2906002)(6486002)(86362001)(6512007)(91956017)(76116006)(6916009)(478600001)(36756003)(316002)(71200400001)(54906003)(966005)(4326008)(66616009)(64756008)(6506007)(186003)(2616005)(33656002)(8936002)(5660300002)(99936003)(26005)(53546011)(83380400001)(66446008)(66476007)(8676002)(66556008)(66946007);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata: wesNxXHm9yl0n7bD0I1Jyindh3tExonjc4bASBmNYgIWoJdnXR+feoQJbuVB4MVzL5s5r568nAjghhwLrtwe7qYu7pvPMTZYC2huHFYAF4QlJ3y0CD2aNI3uhD11rgBhlUK/2U6FWzGvaowQCQW4qPz/IBgfKQwin7zgcYxZ8l4ulT9tSsW30o3ETlnJf0LGXzt9DdUkuRAQdfd5SEaxFvKJ+hb5aBqTQ8AuLIH/vBAJL2JYlV/yvw/q/0NBVpPJhkfbyUhsEs1DSrUSJJnIC45gntuTHYl4hFH8ybEi2vbFuBdyrWS3vW0p4Rg7yrgb13vQq4rrH48KOc5xCIYzlPjBBdzvV+P/P2EyiNYsMTqTm6q87vG2I+w+xJeMiumvF9V5D+qOc7I3dHOrH0a2dBzFuPLLh7MYELneqzM9YWEKz/BvU0S5lAFGgZNNq3fiiM2y7mJKn1cAhnFEAzJ/6bLG6Nr7m+20DNRlne2Num+309O9LFeD8QoreICR7ZFObOvX4/Jg50h9IvVHr1Cet39c49VyTfXbn/hzlH1+NDCGhA3qZQHZfwfoI6AsgjRXja9bpmDXGnXoH4oiNCgOojXACt47cHKjWKY87sluT4TjoeBjig8JT+i8NogYZqV+k3AWYTbaIEFTn7kJMDLYF7CVm1ehc0XzL8AxJk52yU7eAlD6pvyrt+UCBKGTBRLno3OK4Zeu35uCzwzZ6LLG2RBkiLL/MaIgYlRNh/ZXK70WhtywCRiDpLHCmvT2hHdBRW6Jf9br89Kp5rqsRpNn3d5x2LIvoaWGuyqdIP+088TlRe4/LZQKl3terSOPLytW27GSOiHyGkjtFeTXdr82JYjhqtlbWDJR1af9f4RcNnqYszbd28d0g60DBysVlPKp/6hRRyOBZ2/6I3jfHrhIOQ== x-ms-exchange-transport-forked: True Content-Type: multipart/mixed; boundary="_002_5F24348B10BA4AA1999B1E2AB22B4997vmwarecom_" MIME-Version: 1.0 X-OriginatorOrg: vmware.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MWHPR05MB2957.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3f3e365c-fb9d-47a1-7976-08d88a6a4f26 X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Nov 2020 20:00:47.0114 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: b39138ca-3cee-4b4a-a4d6-cd83d9dd62f0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: qxb3wHLDp0/zhCr89yxerDzCz7PQW2OhLON2TmEZMhm8HVTIJPhnTUKmJO8WPbi8HSoStGXn9GhOi59QtA04fw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR05MB3536 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --_002_5F24348B10BA4AA1999B1E2AB22B4997vmwarecom_ Content-Type: text/plain; charset="us-ascii" Content-ID: <53B59B7AF8C34E469BD4A7DC91F10041@namprd05.prod.outlook.com> Content-Transfer-Encoding: quoted-printable On Nov 13, 2020, at 4:14 AM, Daniel Gustafsson wrote: >> On 12 Nov 2020, at 23:12, Jacob Champion wrote: >>=20 >> I'm not completely sure why this is exposed so easily with an OpenSSL >> server -- I'm guessing the implementation slices up its packets >> differently on the wire, causing a read event before NSS is able to >> decrypt a full record -- but it's worth noting that this case also shows >> up during NSS-to-NSS psql connections, when handling notifications at >> the end of every query. PQconsumeInput() reports a hard failure with the >> current implementation, but its return value is ignored by >> PrintNotifications(). Otherwise this probably would have showed up >> earlier. >=20 > Should there perhaps be an Assert there to catch those? Hm. From the perspective of helping developers out, perhaps, but from the standpoint of "don't crash when an endpoint outside our control does something strange", I think that's a harder sell. Should the error be bubbled all the way up instead? Or perhaps, if psql isn't supposed to treat notification errors as "hard" failures, it should at least warn the user that something is fishy? >> (What's the best way to test this case? Are there lower-level tests for >> the protocol/network layer somewhere that I'm missing?) >=20 > Not AFAIK. Having been knee-deep now, do you have any ideas on how to > implement? I think that testing these sorts of important edge cases needs a friendly DSL -- something that doesn't want to make devs tear their hair out while building tests. I've been playing a little bit with Scapy [1] to understand more of the libpq v3 protocol; I'll see if that can be adapted for pieces of the TLS handshake in a way that's easy to maintain. If it can be, maybe that'd be a good starting example. > I've incorporated this patch as well as the previous patch for the assert= ion > failure on private callback data into the attached v19 patchset. I also = did a > spellcheck and pgindent run on it for ease of review. Commit 6be725e70 got rid of some psql error messaging that the tests were keying off of, so there are a few new failures after a rebase onto latest master. I've attached a patch that gets the SCRAM tests a little further (certificate hashing was caught in an infinite loop). I also added error checks to those loops, along the lines of the existing OpenSSL implementation: if a suitable digest can't be found, the user will see an error like psql: error: could not find digest for OID 'PKCS #1 SHA-256 With RSA En= cryption' It's a little verbose but I don't think this case should come up in normal practice. --Jacob [1] https://scapy.net/ --_002_5F24348B10BA4AA1999B1E2AB22B4997vmwarecom_ Content-Type: application/octet-stream; name="nss-fix-hang-when-hashing-certificates.patch" Content-Description: nss-fix-hang-when-hashing-certificates.patch Content-Disposition: attachment; filename="nss-fix-hang-when-hashing-certificates.patch"; size=3246; creation-date="Mon, 16 Nov 2020 20:00:46 GMT"; modification-date="Mon, 16 Nov 2020 20:00:46 GMT" Content-ID: <2254BED37BB6894EACC167C3C2267C9F@namprd05.prod.outlook.com> Content-Transfer-Encoding: base64 RnJvbSAyZjFkNThmOWMzNzY0MjljYTNmZjg0ZDA0ODk4MjQ2MDNkMmJjZDUyIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBKYWNvYiBDaGFtcGlvbiA8cGNoYW1waW9uQHZtd2FyZS5jb20+ CkRhdGU6IE1vbiwgMTYgTm92IDIwMjAgMDg6NTU6MzMgLTA4MDAKU3ViamVjdDogW1BBVENIXSBu c3M6IGZpeCBoYW5nIHdoZW4gaGFzaGluZyBjZXJ0aWZpY2F0ZXMKCi0tLQogc3JjL2JhY2tlbmQv bGlicHEvYmUtc2VjdXJlLW5zcy5jICAgIHwgMTkgKysrKysrKysrKysrLS0tLS0tLQogc3JjL2lu dGVyZmFjZXMvbGlicHEvZmUtc2VjdXJlLW5zcy5jIHwgMjIgKysrKysrKysrKysrKysrKy0tLS0t LQogMiBmaWxlcyBjaGFuZ2VkLCAyOCBpbnNlcnRpb25zKCspLCAxMyBkZWxldGlvbnMoLSkKCmRp ZmYgLS1naXQgYS9zcmMvYmFja2VuZC9saWJwcS9iZS1zZWN1cmUtbnNzLmMgYi9zcmMvYmFja2Vu ZC9saWJwcS9iZS1zZWN1cmUtbnNzLmMKaW5kZXggZTc1NDBjNDc1Ni4uYjE5ODJlZTU5NiAxMDA2 NDQKLS0tIGEvc3JjL2JhY2tlbmQvbGlicHEvYmUtc2VjdXJlLW5zcy5jCisrKyBiL3NyYy9iYWNr ZW5kL2xpYnBxL2JlLXNlY3VyZS1uc3MuYwpAQCAtODEzLDYgKzgxMyw3IEBAIGJlX3Rsc19nZXRf Y2VydGlmaWNhdGVfaGFzaChQb3J0ICpwb3J0LCBzaXplX3QgKmxlbikKIAlTRUNPaWRUYWcJc2ln bmF0dXJlX2FsZzsKIAlTRUNPaWRUYWcJZGlnZXN0X2FsZzsKIAlpbnQJCQlkaWdlc3RfbGVuOwor CWNvbnN0IE5TU1NpZ25hdHVyZUFsZ29yaXRobXMgKmNhbmRpZGF0ZTsKIAlTRUNTdGF0dXMJc3Rh dHVzOwogCVBMQXJlbmFQb29sICphcmVuYSA9IE5VTEw7CiAJU0VDSXRlbQkJZGlnZXN0OwpAQCAt ODI0LDIwICs4MjUsMjQgQEAgYmVfdGxzX2dldF9jZXJ0aWZpY2F0ZV9oYXNoKFBvcnQgKnBvcnQs IHNpemVfdCAqbGVuKQogCQlyZXR1cm4gTlVMTDsKIAogCXNpZ25hdHVyZV9hbGcgPSBTRUNPSURf R2V0QWxnb3JpdGhtVGFnKCZjZXJ0aWZpY2F0ZS0+c2lnbmF0dXJlKTsKLQkvKiBTZXQgc2hhLTI1 NiBhcyBhIGRlZmF1bHQgKi8KLQlkaWdlc3RfYWxnID0gU0VDX09JRF9TSEEyNTY7Ci0JZGlnZXN0 X2xlbiA9IFNIQTI1Nl9MRU5HVEg7CiAKLQl3aGlsZSAoTlNTX1NDUkFNRGlnZXN0QWxnb3JpdGht LT5zaWduYXR1cmUpCisJY2FuZGlkYXRlID0gTlNTX1NDUkFNRGlnZXN0QWxnb3JpdGhtOworCXdo aWxlIChjYW5kaWRhdGUtPnNpZ25hdHVyZSkKIAl7Ci0JCWlmIChzaWduYXR1cmVfYWxnID09IE5T U19TQ1JBTURpZ2VzdEFsZ29yaXRobS0+c2lnbmF0dXJlKQorCQlpZiAoc2lnbmF0dXJlX2FsZyA9 PSBjYW5kaWRhdGUtPnNpZ25hdHVyZSkKIAkJewotCQkJZGlnZXN0X2FsZyA9IE5TU19TQ1JBTURp Z2VzdEFsZ29yaXRobS0+aGFzaDsKLQkJCWRpZ2VzdF9sZW4gPSBOU1NfU0NSQU1EaWdlc3RBbGdv cml0aG0tPmxlbjsKKwkJCWRpZ2VzdF9hbGcgPSBjYW5kaWRhdGUtPmhhc2g7CisJCQlkaWdlc3Rf bGVuID0gY2FuZGlkYXRlLT5sZW47CiAJCQlicmVhazsKIAkJfQorCisJCWNhbmRpZGF0ZSsrOwog CX0KIAorCWlmICghY2FuZGlkYXRlLT5zaWduYXR1cmUpCisJCWVsb2coRVJST1IsICJjb3VsZCBu b3QgZmluZCBkaWdlc3QgZm9yIE9JRCAnJXMnIiwKKwkJCSBTRUNPSURfRmluZE9JRFRhZ0Rlc2Ny aXB0aW9uKHNpZ25hdHVyZV9hbGcpKTsKKwogCWFyZW5hID0gUE9SVF9OZXdBcmVuYShTRUNfQVNO MV9ERUZBVUxUX0FSRU5BX1NJWkUpOwogCWRpZ2VzdC5kYXRhID0gUE9SVF9BcmVuYVpBbGxvYyhh cmVuYSwgc2l6ZW9mKHVuc2lnbmVkIGNoYXIpICogZGlnZXN0X2xlbik7CiAJZGlnZXN0LmxlbiA9 IGRpZ2VzdF9sZW47CmRpZmYgLS1naXQgYS9zcmMvaW50ZXJmYWNlcy9saWJwcS9mZS1zZWN1cmUt bnNzLmMgYi9zcmMvaW50ZXJmYWNlcy9saWJwcS9mZS1zZWN1cmUtbnNzLmMKaW5kZXggNzg3YmMx NDBhNi4uMmYxMGU5NGY3MiAxMDA2NDQKLS0tIGEvc3JjL2ludGVyZmFjZXMvbGlicHEvZmUtc2Vj dXJlLW5zcy5jCisrKyBiL3NyYy9pbnRlcmZhY2VzL2xpYnBxL2ZlLXNlY3VyZS1uc3MuYwpAQCAt NTQwLDYgKzU0MCw3IEBAIHBndGxzX2dldF9wZWVyX2NlcnRpZmljYXRlX2hhc2goUEdjb25uICpj b25uLCBzaXplX3QgKmxlbikKIAlTRUNPaWRUYWcJc2lnbmF0dXJlX2FsZzsKIAlTRUNPaWRUYWcJ ZGlnZXN0X2FsZzsKIAlpbnQJCQlkaWdlc3RfbGVuOworCWNvbnN0IE5TU1NpZ25hdHVyZUFsZ29y aXRobXMgKmNhbmRpZGF0ZTsKIAlQTEFyZW5hUG9vbCAqYXJlbmE7CiAJU0VDSXRlbQkJZGlnZXN0 OwogCWNoYXIJICAgKnJldDsKQEAgLTU1MiwxNyArNTUzLDI2IEBAIHBndGxzX2dldF9wZWVyX2Nl cnRpZmljYXRlX2hhc2goUEdjb25uICpjb25uLCBzaXplX3QgKmxlbikKIAkJcmV0dXJuIE5VTEw7 CiAKIAlzaWduYXR1cmVfYWxnID0gU0VDT0lEX0dldEFsZ29yaXRobVRhZygmc2VydmVyX2NlcnQt PnNpZ25hdHVyZSk7Ci0JZGlnZXN0X2FsZyA9IFNFQ19PSURfU0hBMjU2OwotCWRpZ2VzdF9sZW4g PSBTSEEyNTZfTEVOR1RIOwogCi0Jd2hpbGUgKE5TU19TQ1JBTURpZ2VzdEFsZ29yaXRobS0+c2ln bmF0dXJlKQorCWNhbmRpZGF0ZSA9IE5TU19TQ1JBTURpZ2VzdEFsZ29yaXRobTsKKwl3aGlsZSAo Y2FuZGlkYXRlLT5zaWduYXR1cmUpCiAJewotCQlpZiAoc2lnbmF0dXJlX2FsZyA9PSBOU1NfU0NS QU1EaWdlc3RBbGdvcml0aG0tPnNpZ25hdHVyZSkKKwkJaWYgKHNpZ25hdHVyZV9hbGcgPT0gY2Fu ZGlkYXRlLT5zaWduYXR1cmUpCiAJCXsKLQkJCWRpZ2VzdF9hbGcgPSBOU1NfU0NSQU1EaWdlc3RB bGdvcml0aG0tPmhhc2g7Ci0JCQlkaWdlc3RfbGVuID0gTlNTX1NDUkFNRGlnZXN0QWxnb3JpdGht LT5sZW47CisJCQlkaWdlc3RfYWxnID0gY2FuZGlkYXRlLT5oYXNoOworCQkJZGlnZXN0X2xlbiA9 IGNhbmRpZGF0ZS0+bGVuOwogCQkJYnJlYWs7CiAJCX0KKworCQljYW5kaWRhdGUrKzsKKwl9CisK KwlpZiAoIWNhbmRpZGF0ZS0+c2lnbmF0dXJlKQorCXsKKwkJcHJpbnRmUFFFeHBCdWZmZXIoJmNv bm4tPmVycm9yTWVzc2FnZSwKKwkJCQkJCSAgbGlicHFfZ2V0dGV4dCgiY291bGQgbm90IGZpbmQg ZGlnZXN0IGZvciBPSUQgJyVzJ1xuIiksCisJCQkJCQkgIFNFQ09JRF9GaW5kT0lEVGFnRGVzY3Jp cHRpb24oc2lnbmF0dXJlX2FsZykpOworCQlyZXR1cm4gTlVMTDsKIAl9CiAKIAlhcmVuYSA9IFBP UlRfTmV3QXJlbmEoU0VDX0FTTjFfREVGQVVMVF9BUkVOQV9TSVpFKTsKLS0gCjIuMjQuMQoK --_002_5F24348B10BA4AA1999B1E2AB22B4997vmwarecom_--