Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1olqsb-0005pn-Mx for pgsql-hackers@arkaria.postgresql.org; Fri, 21 Oct 2022 12:12:02 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1olqsZ-0000LQ-L5 for pgsql-hackers@arkaria.postgresql.org; Fri, 21 Oct 2022 12:11:59 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1olqsZ-0000LH-70 for pgsql-hackers@lists.postgresql.org; Fri, 21 Oct 2022 12:11:59 +0000 Received: from mail-wr1-x434.google.com ([2a00:1450:4864:20::434]) by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1olqsX-0004DQ-0v for pgsql-hackers@lists.postgresql.org; Fri, 21 Oct 2022 12:11:58 +0000 Received: by mail-wr1-x434.google.com with SMTP id f11so4117754wrm.6 for ; Fri, 21 Oct 2022 05:11:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=in-reply-to:from:references:cc:to:content-language:subject :user-agent:mime-version:date:message-id:from:to:cc:subject:date :message-id:reply-to; bh=FQenR3rCESFHF3CtOLPi1bwn8wMkEcpyftAL1+ElTvE=; b=caYxlpWy/+YJO6J6Gbl6VGImOlnDoYQT3A4lfpleUYi94ReDd4hEjPAyjsQWN79kz5 JVxinjFj7p1uAyZrD0+uPdcb8xnwSgzwdXPLwR6tqqu6KbCOOtBmISkjyyYYFP3e8GzD B0aO1o6kVwQy7iI6seWpLA5ueZObAmm7Taovq2hFf2RgKc4EssKr40bovUDeceOcWyZd C1m7y1rrgllCmLrzLjynHYRbP9t6LH7E4fgQmE4pLSy80EkDu7XHWJC1b0gg+GCbiA7j +eOjV6RNs2huTT6ADwHkpkVbfnaabWedE4DgZeNQhm8+kFWXXtU7kCQ8JvMseDTIEjdO vSBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:from:references:cc:to:content-language:subject :user-agent:mime-version:date:message-id:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=FQenR3rCESFHF3CtOLPi1bwn8wMkEcpyftAL1+ElTvE=; b=fH1zM1CwYOL2xyGvuosIwypB+U/ATttxJ3gMBQ/Q0YkqQXBgb3hELloNUr9uM8qa+u ITiWoJtQUmieIhKuL3xkGyAmknbcTNTsD71SXCEdhdsQZMBXN0QFVnewsN1F8IHfzzK/ fLcbrDps2q5hFv/610E9vrVmqVvNtdVrL8ThwFlcGbnGgOx7LzRCTtMOvpSDisON7wpW FEau29OfUmkmH9YBhNbb08eUx7qbmGV9h73LcP/gsiQ4kpZt0r26oWWj4bdC3gljW/SF GcRijURRJzdzDJJ3OsLWmT1/tkEsztLuU/Rl+YVpAYVWSKyCDdsKg+w6vF7vLTxQZymA HgNw== X-Gm-Message-State: ACrzQf0HOsWHy1IbayZaVw4UleW0tTsOWj8n74xDSU1FFlSJOyrfE5xN I3YeS3lcsoR1dcyRatWwHJM= X-Google-Smtp-Source: AMsMyM7gsuQ+GRBhjm6wuzd7IPOmeh8tOJJnnsnlBBbMJ+xK+HjYIG2LjhLd5g8do097JwjaXsj7jw== X-Received: by 2002:adf:d215:0:b0:22e:479e:8cc1 with SMTP id j21-20020adfd215000000b0022e479e8cc1mr12709480wrh.39.1666354315067; Fri, 21 Oct 2022 05:11:55 -0700 (PDT) Received: from [10.95.82.155] ([54.239.6.188]) by smtp.gmail.com with ESMTPSA id j5-20020a05600c488500b003c6c4639ac6sm2188876wmp.34.2022.10.21.05.11.53 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 21 Oct 2022 05:11:54 -0700 (PDT) Content-Type: multipart/mixed; boundary="------------oS4YfKTv14upNARabBagJ0ob" Message-ID: <6a6977ac-e4d5-5ac4-8cfb-453248946e0a@gmail.com> Date: Fri, 21 Oct 2022 14:10:37 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Thunderbird/102.4.0 Subject: Re: Patch proposal: make use of regular expressions for the username in pg_hba.conf Content-Language: en-US To: Michael Paquier Cc: Tom Lane , Jacob Champion , PostgreSQL Hackers References: <572017.1663646973@sss.pgh.pa.us> <607af3c9-e45d-3941-41a2-d21065d6594b@gmail.com> From: "Drouvot, Bertrand" In-Reply-To: List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk This is a multi-part message in MIME format. --------------oS4YfKTv14upNARabBagJ0ob Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hi, On 10/21/22 2:58 AM, Michael Paquier wrote: > On Wed, Oct 19, 2022 at 10:45:44AM +0200, Drouvot, Bertrand wrote: >> Please find attached v1-0001-regex-handling-for-db-and-roles-in-hba.patch to >> implement regexes for databases and roles in hba. >> >> It does also contain new regexes related TAP tests and doc updates. > > Thanks for the updated version. This is really easy to look at now. > >> It relies on the refactoring made in fc579e11c6 (but changes the >> regcomp_auth_token() parameters so that it is now responsible for emitting >> the compilation error message (if any), to avoid code duplication in >> parse_hba_line() and parse_ident_line() for roles, databases and user name >> mapping). > > @@ -652,13 +670,18 @@ check_role(const char *role, Oid roleid, List *tokens) > [...] > - if (!tok->quoted && tok->string[0] == '+') > + if (!token_has_regexp(tok)) > { > Hmm. Do we need token_has_regexp() here for all the cases? We know > that the string can begin with a '+', hence it is no regex. The same > applies for the case of "all". The remaining case is the one where > the user name matches exactly the AuthToken string, which should be > last as we want to treat anything beginning with a '/' as a regex. It > seems like we could do an order like that? Say: > if (!tok->quoted && tok->string[0] == '+') > //do > else if (token_is_keyword(tok, "all")) > //do > else if (token_has_regexp(tok)) > //do regex compilation, handling failures > else if (token_matches(tok, role)) > //do exact match > > The same approach with keywords first, regex, and exact match could be > applied as well for the databases? Perhaps it is just mainly a matter > of taste, Yeah, I think it is. > and it depends on how much you want to prioritize the place > of the regex over the rest but that could make the code easier to > understand in the long-run and this is a very sensitive code area, And agree that your proposal tastes better ;-): it is easier to understand, v2 attached has been done that way. > Compiling the expressions for the user and database lists one-by-one > in parse_hba_line() as you do is correct. However there is a gotcha > that you are forgetting here: the memory allocations done for the > regexp compilations are not linked to the memory context where each > line is processed (named hbacxt in load_hba()) and need a separate > cleanup. Oops, right, thanks for the call out! > In the same fashion as load_ident(), it seems to me that we > need two extra things for this patch: > - if !ok (see where we do MemoryContextDelete(hbacxt)), we need to go > through new_parsed_lines and free for each line the AuthTokens for the > database and user lists. > - if ok and new_parsed_lines != NIL, the same cleanup needs to > happen. Right, but I think that should be "parsed_hba_lines != NIL". > My guess is that you could do both the same way as load_ident() does, > keeping some symmetry between the two code paths. Right. To avoid code duplication in the !ok/ok cases, the function free_hba_line() has been added in v2: it goes through the list of databases and roles tokens and call free_auth_token() for each of them. > Unifying both into > a common routine would be sort of annoying as HbaLines uses lists > within the lists of parsed lines, and IdentLine can have one at most > in each line. I agree, and v2 is not attempting to unify them. > For now, I have made your last patch a bit shorter by applying the > refactoring of regcomp_auth_token() separately with a few tweaks to > the comments. Thanks! v2 attached does apply on top of that. Regards, -- Bertrand Drouvot PostgreSQL Contributors Team RDS Open Source Databases Amazon Web Services: https://aws.amazon.com --------------oS4YfKTv14upNARabBagJ0ob Content-Type: text/plain; charset=UTF-8; name="v2-0001-regex-handling-for-db-and-roles-in-hba.patch" Content-Disposition: attachment; filename="v2-0001-regex-handling-for-db-and-roles-in-hba.patch" Content-Transfer-Encoding: base64 ZGlmZiAtLWdpdCBhL2RvYy9zcmMvc2dtbC9jbGllbnQtYXV0aC5zZ21sIGIvZG9jL3NyYy9z Z21sL2NsaWVudC1hdXRoLnNnbWwKaW5kZXggYzZmMWI3MGZkMy4uMzA3NTMwMDNiYSAxMDA2 NDQKLS0tIGEvZG9jL3NyYy9zZ21sL2NsaWVudC1hdXRoLnNnbWwKKysrIGIvZG9jL3NyYy9z Z21sL2NsaWVudC1hdXRoLnNnbWwKQEAgLTIzNCwxMCArMjM0LDEzIEBAIGhvc3Rub2dzc2Vu YyAgPHJlcGxhY2VhYmxlPmRhdGFiYXNlPC9yZXBsYWNlYWJsZT4gIDxyZXBsYWNlYWJsZT51 c2VyPC9yZXBsYWNlYWJsCiAgICAgICAgcmVwbGljYXRpb24gY29ubmVjdGlvbnMgZG8gbm90 IHNwZWNpZnkgYW55IHBhcnRpY3VsYXIgZGF0YWJhc2Ugd2hlcmVhcwogICAgICAgIGxvZ2lj YWwgcmVwbGljYXRpb24gY29ubmVjdGlvbnMgZG8gc3BlY2lmeSBpdC4KICAgICAgICBPdGhl cndpc2UsIHRoaXMgaXMgdGhlIG5hbWUgb2YKLSAgICAgICBhIHNwZWNpZmljIDxwcm9kdWN0 bmFtZT5Qb3N0Z3JlU1FMPC9wcm9kdWN0bmFtZT4gZGF0YWJhc2UuCi0gICAgICAgTXVsdGlw bGUgZGF0YWJhc2UgbmFtZXMgY2FuIGJlIHN1cHBsaWVkIGJ5IHNlcGFyYXRpbmcgdGhlbSB3 aXRoCi0gICAgICAgY29tbWFzLiAgQSBzZXBhcmF0ZSBmaWxlIGNvbnRhaW5pbmcgZGF0YWJh c2UgbmFtZXMgY2FuIGJlIHNwZWNpZmllZCBieQotICAgICAgIHByZWNlZGluZyB0aGUgZmls ZSBuYW1lIHdpdGggPGxpdGVyYWw+QDwvbGl0ZXJhbD4uCisgICAgICAgYSBzcGVjaWZpYyA8 cHJvZHVjdG5hbWU+UG9zdGdyZVNRTDwvcHJvZHVjdG5hbWU+IGRhdGFiYXNlIG9yIGEgcmVn dWxhcgorICAgICAgIGV4cHJlc3Npb24gcHJlY2VkZWQgYnkgPGxpdGVyYWw+LzwvbGl0ZXJh bD4uCisgICAgICAgTXVsdGlwbGUgZGF0YWJhc2UgbmFtZXMgYW5kL29yIHJlZ3VsYXIgZXhw cmVzc2lvbnMgcHJlY2VkZWQgYnkgPGxpdGVyYWw+LzwvbGl0ZXJhbD4KKyAgICAgICBjYW4g YmUgc3VwcGxpZWQgYnkgc2VwYXJhdGluZyB0aGVtIHdpdGggY29tbWFzLgorICAgICAgIEEg c2VwYXJhdGUgZmlsZSBjb250YWluaW5nIGRhdGFiYXNlIG5hbWVzIGFuZC9vciByZWd1bGFy IGV4cHJlc3Npb25zIHByZWNlZGVkCisgICAgICAgYnkgPGxpdGVyYWw+LzwvbGl0ZXJhbD4g Y2FuIGJlIHNwZWNpZmllZCBieSBwcmVjZWRpbmcgdGhlIGZpbGUgbmFtZQorICAgICAgIHdp dGggPGxpdGVyYWw+QDwvbGl0ZXJhbD4uCiAgICAgICA8L3BhcmE+CiAgICAgIDwvbGlzdGl0 ZW0+CiAgICAgPC92YXJsaXN0ZW50cnk+CkBAIC0yNDksMTggKzI1MiwyMCBAQCBob3N0bm9n c3NlbmMgIDxyZXBsYWNlYWJsZT5kYXRhYmFzZTwvcmVwbGFjZWFibGU+ICA8cmVwbGFjZWFi bGU+dXNlcjwvcmVwbGFjZWFibAogICAgICAgIFNwZWNpZmllcyB3aGljaCBkYXRhYmFzZSB1 c2VyIG5hbWUocykgdGhpcyByZWNvcmQKICAgICAgICBtYXRjaGVzLiBUaGUgdmFsdWUgPGxp dGVyYWw+YWxsPC9saXRlcmFsPiBzcGVjaWZpZXMgdGhhdCBpdAogICAgICAgIG1hdGNoZXMg YWxsIHVzZXJzLiAgT3RoZXJ3aXNlLCB0aGlzIGlzIGVpdGhlciB0aGUgbmFtZSBvZiBhIHNw ZWNpZmljCi0gICAgICAgZGF0YWJhc2UgdXNlciwgb3IgYSBncm91cCBuYW1lIHByZWNlZGVk IGJ5IDxsaXRlcmFsPis8L2xpdGVyYWw+LgorICAgICAgIGRhdGFiYXNlIHVzZXIsIGEgcmVn dWxhciBleHByZXNzaW9uIHByZWNlZGVkIGJ5IDxsaXRlcmFsPi88L2xpdGVyYWw+LAorICAg ICAgIG9yIGEgZ3JvdXAgbmFtZSBwcmVjZWRlZCBieSA8bGl0ZXJhbD4rPC9saXRlcmFsPi4K ICAgICAgICAoUmVjYWxsIHRoYXQgdGhlcmUgaXMgbm8gcmVhbCBkaXN0aW5jdGlvbiBiZXR3 ZWVuIHVzZXJzIGFuZCBncm91cHMKICAgICAgICBpbiA8cHJvZHVjdG5hbWU+UG9zdGdyZVNR TDwvcHJvZHVjdG5hbWU+OyBhIDxsaXRlcmFsPis8L2xpdGVyYWw+IG1hcmsgcmVhbGx5IG1l YW5zCiAgICAgICAgPHF1b3RlPm1hdGNoIGFueSBvZiB0aGUgcm9sZXMgdGhhdCBhcmUgZGly ZWN0bHkgb3IgaW5kaXJlY3RseSBtZW1iZXJzCiAgICAgICAgb2YgdGhpcyByb2xlPC9xdW90 ZT4sIHdoaWxlIGEgbmFtZSB3aXRob3V0IGEgPGxpdGVyYWw+KzwvbGl0ZXJhbD4gbWFyayBt YXRjaGVzCi0gICAgICAgb25seSB0aGF0IHNwZWNpZmljIHJvbGUuKSBGb3IgdGhpcyBwdXJw b3NlLCBhIHN1cGVydXNlciBpcyBvbmx5CisgICAgICAgb25seSB0aGF0IHNwZWNpZmljIHJv bGUgb3IgcmVndWxhciBleHByZXNzaW9uLikgRm9yIHRoaXMgcHVycG9zZSwgYSBzdXBlcnVz ZXIgaXMgb25seQogICAgICAgIGNvbnNpZGVyZWQgdG8gYmUgYSBtZW1iZXIgb2YgYSByb2xl IGlmIHRoZXkgYXJlIGV4cGxpY2l0bHkgYSBtZW1iZXIKICAgICAgICBvZiB0aGUgcm9sZSwg ZGlyZWN0bHkgb3IgaW5kaXJlY3RseSwgYW5kIG5vdCBqdXN0IGJ5IHZpcnR1ZSBvZgogICAg ICAgIGJlaW5nIGEgc3VwZXJ1c2VyLgotICAgICAgIE11bHRpcGxlIHVzZXIgbmFtZXMgY2Fu IGJlIHN1cHBsaWVkIGJ5IHNlcGFyYXRpbmcgdGhlbSB3aXRoIGNvbW1hcy4KLSAgICAgICBB IHNlcGFyYXRlIGZpbGUgY29udGFpbmluZyB1c2VyIG5hbWVzIGNhbiBiZSBzcGVjaWZpZWQg YnkgcHJlY2VkaW5nIHRoZQotICAgICAgIGZpbGUgbmFtZSB3aXRoIDxsaXRlcmFsPkA8L2xp dGVyYWw+LgorICAgICAgIE11bHRpcGxlIHVzZXIgbmFtZXMgYW5kL29yIHJlZ3VsYXIgZXhw cmVzc2lvbnMgcHJlY2VkZWQgYnkgPGxpdGVyYWw+LzwvbGl0ZXJhbD4KKyAgICAgICBjYW4g YmUgc3VwcGxpZWQgYnkgc2VwYXJhdGluZyB0aGVtIHdpdGggY29tbWFzLiBBIHNlcGFyYXRl IGZpbGUgY29udGFpbmluZworICAgICAgIHVzZXIgbmFtZXMgYW5kL29yIHJlZ3VsYXIgZXhw cmVzc2lvbnMgcHJlY2VkZWQgYnkgPGxpdGVyYWw+LzwvbGl0ZXJhbD4KKyAgICAgICBjYW4g YmUgc3BlY2lmaWVkIGJ5IHByZWNlZGluZyB0aGUgZmlsZSBuYW1lIHdpdGggPGxpdGVyYWw+ QDwvbGl0ZXJhbD4uCiAgICAgICA8L3BhcmE+CiAgICAgIDwvbGlzdGl0ZW0+CiAgICAgPC92 YXJsaXN0ZW50cnk+CkBAIC03MzksNiArNzQ0LDE4IEBAIGhvc3QgICAgYWxsICAgICAgICAg ICAgIGFsbCAgICAgICAgICAgICA6OjEvMTI4ICAgICAgICAgICAgICAgICB0cnVzdAogIyBU WVBFICBEQVRBQkFTRSAgICAgICAgVVNFUiAgICAgICAgICAgIEFERFJFU1MgICAgICAgICAg ICAgICAgIE1FVEhPRAogaG9zdCAgICBhbGwgICAgICAgICAgICAgYWxsICAgICAgICAgICAg IGxvY2FsaG9zdCAgICAgICAgICAgICAgIHRydXN0CiAKKyMgVGhlIHNhbWUgdXNpbmcgcmVn dWxhciBleHByZXNzaW9uIGZvciBEQVRBQkFTRSwgd2hpY2ggYWxsb3dzIGNvbm5lY3Rpb24g dG8gdGhlCisjIGRiMSBhbmQgdGVzdGRiIGRhdGFiYXNlcyBhbmQgYW55IGRhdGFiYXNlIHdp dGggYSBuYW1lIGVuZGluZyB3aXRoICJ0ZXN0Ii4KKyMKKyMgVFlQRSAgREFUQUJBU0UgICAg ICAgICAgICAgICBVU0VSICAgICAgICAgICAgQUREUkVTUyAgICAgICAgICBNRVRIT0QKK2xv Y2FsICAgZGIxLC9eLip0ZXN0JCx0ZXN0ZGIgICBhbGwgICAgICAgICAgICAgbG9jYWxob3N0 ICAgICAgICB0cnVzdAorCisjIFRoZSBzYW1lIHVzaW5nIHJlZ3VsYXIgZXhwcmVzc2lvbiBm b3IgVVNFUiwgd2hpY2ggYWxsb3dzIGNvbm5lY3Rpb24gdG8gdGhlCisjIHVzZXIxIGFuZCB0 ZXN0dXNlciB1c2VycyBhbmQgYW55IHVzZXIgd2l0aCBhIG5hbWUgZW5kaW5nIHdpdGggInRl c3QiLgorIworIyBUWVBFICBEQVRBQkFTRSAgICAgICAgICAgICAgICAgVVNFUiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIEFERFJFU1MgICAgICAgICAgTUVUSE9ECitsb2NhbCAg IGRiMSwvXi4qdGVzdCQsdGVzdGRiICAgICB1c2VyMSwvXi4qdGVzdCQsdGVzdHVzZXIgICAg ICAgICAgbG9jYWxob3N0ICAgICAgICB0cnVzdAorCiAjIEFsbG93IGFueSB1c2VyIGZyb20g YW55IGhvc3Qgd2l0aCBJUCBhZGRyZXNzIDE5Mi4xNjguOTMueCB0byBjb25uZWN0CiAjIHRv IGRhdGFiYXNlICJwb3N0Z3JlcyIgYXMgdGhlIHNhbWUgdXNlciBuYW1lIHRoYXQgaWRlbnQg cmVwb3J0cyBmb3IKICMgdGhlIGNvbm5lY3Rpb24gKHR5cGljYWxseSB0aGUgb3BlcmF0aW5n IHN5c3RlbSB1c2VyIG5hbWUpLgpAQCAtNzg1LDE1ICs4MDIsMTcgQEAgaG9zdCAgICBhbGwg ICAgICAgICAgICAgYWxsICAgICAgICAgICAgIDE5Mi4xNjguMTIuMTAvMzIgICAgICAgIGdz cwogIyBUWVBFICBEQVRBQkFTRSAgICAgICAgVVNFUiAgICAgICAgICAgIEFERFJFU1MgICAg ICAgICAgICAgICAgIE1FVEhPRAogaG9zdCAgICBhbGwgICAgICAgICAgICAgYWxsICAgICAg ICAgICAgIDE5Mi4xNjguMC4wLzE2ICAgICAgICAgIGlkZW50IG1hcD1vbWljcm9uCiAKLSMg SWYgdGhlc2UgYXJlIHRoZSBvbmx5IHRocmVlIGxpbmVzIGZvciBsb2NhbCBjb25uZWN0aW9u cywgdGhleSB3aWxsCisjIElmIHRoZXNlIGFyZSB0aGUgb25seSBmb3VyIGxpbmVzIGZvciBs b2NhbCBjb25uZWN0aW9ucywgdGhleSB3aWxsCiAjIGFsbG93IGxvY2FsIHVzZXJzIHRvIGNv bm5lY3Qgb25seSB0byB0aGVpciBvd24gZGF0YWJhc2VzIChkYXRhYmFzZXMKLSMgd2l0aCB0 aGUgc2FtZSBuYW1lIGFzIHRoZWlyIGRhdGFiYXNlIHVzZXIgbmFtZSkgZXhjZXB0IGZvciBh ZG1pbmlzdHJhdG9ycwotIyBhbmQgbWVtYmVycyBvZiByb2xlICJzdXBwb3J0Iiwgd2hvIGNh biBjb25uZWN0IHRvIGFsbCBkYXRhYmFzZXMuICBUaGUgZmlsZQotIyAkUEdEQVRBL2FkbWlu cyBjb250YWlucyBhIGxpc3Qgb2YgbmFtZXMgb2YgYWRtaW5pc3RyYXRvcnMuICBQYXNzd29y ZHMKKyMgd2l0aCB0aGUgc2FtZSBuYW1lIGFzIHRoZWlyIGRhdGFiYXNlIHVzZXIgbmFtZSkg ZXhjZXB0IGZvciB1c2VycyBlbmRpbmcKKyMgd2l0aCAiaGVscGRlc2siLCBhZG1pbmlzdHJh dG9ycyBhbmQgbWVtYmVycyBvZiByb2xlICJzdXBwb3J0IiwKKyMgd2hvIGNhbiBjb25uZWN0 IHRvIGFsbCBkYXRhYmFzZXMuCisjIFRoZSBmaWxlICRQR0RBVEEvYWRtaW5zIGNvbnRhaW5z IGEgbGlzdCBvZiBuYW1lcyBvZiBhZG1pbmlzdHJhdG9ycy4gIFBhc3N3b3JkcwogIyBhcmUg cmVxdWlyZWQgaW4gYWxsIGNhc2VzLgogIwogIyBUWVBFICBEQVRBQkFTRSAgICAgICAgVVNF UiAgICAgICAgICAgIEFERFJFU1MgICAgICAgICAgICAgICAgIE1FVEhPRAogbG9jYWwgICBz YW1ldXNlciAgICAgICAgYWxsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IG1kNQorbG9jYWwgICBhbGwgICAgICAgICAgICAgL14uKmhlbHBkZXNrJCAgICAgICAgICAg ICAgICAgICAgICAgICAgIG1kNQogbG9jYWwgICBhbGwgICAgICAgICAgICAgQGFkbWlucyAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1kNQogbG9jYWwgICBhbGwgICAgICAg ICAgICAgK3N1cHBvcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1kNQogCmRp ZmYgLS1naXQgYS9zcmMvYmFja2VuZC9saWJwcS9oYmEuYyBiL3NyYy9iYWNrZW5kL2xpYnBx L2hiYS5jCmluZGV4IGYzNTM5YTc5MjkuLjBlMjE4NWQzNWUgMTAwNjQ0Ci0tLSBhL3NyYy9i YWNrZW5kL2xpYnBxL2hiYS5jCisrKyBiL3NyYy9iYWNrZW5kL2xpYnBxL2hiYS5jCkBAIC0y OTMsNiArMjkzLDMxIEBAIGZyZWVfYXV0aF90b2tlbihBdXRoVG9rZW4gKnRva2VuKQogCQlw Z19yZWdmcmVlKHRva2VuLT5yZWdleCk7CiB9CiAKKy8qCisgKiBGcmVlIGEgSGJhTGluZSwg dGhhdCBtYXkgaW5jbHVkZSBkYXRhYmFzZXMgYW5kL29yIHJvbGVzIEF1dGhUb2tlbiB3aXRo IGEKKyAqIHJlZ3VsYXIgZXhwcmVzc2lvbiB0aGF0IG5lZWRzIHRvIGJlIGNsZWFuZWQgdXAg ZXhwbGljaXRseS4KKyAqLworc3RhdGljIHZvaWQKK2ZyZWVfaGJhX2xpbmUoSGJhTGluZSAq bGluZSkKK3sKKwlMaXN0Q2VsbCAgICpjZWxsOworCUF1dGhUb2tlbiAgKnRvazsKKworCS8q IENsZWFuIHVwIHJvbGVzIHJlZ2V4ZXMgKi8KKwlmb3JlYWNoKGNlbGwsIGxpbmUtPnJvbGVz KQorCXsKKwkJdG9rID0gbGZpcnN0KGNlbGwpOworCQlmcmVlX2F1dGhfdG9rZW4odG9rKTsK Kwl9CisKKwkvKiBDbGVhbiB1cCBkYXRhYmFzZXMgcmVnZXhlcyAqLworCWZvcmVhY2goY2Vs bCwgbGluZS0+ZGF0YWJhc2VzKQorCXsKKwkJdG9rID0gbGZpcnN0KGNlbGwpOworCQlmcmVl X2F1dGhfdG9rZW4odG9rKTsKKwl9Cit9CisKIC8qCiAgKiBDb3B5IGEgQXV0aFRva2VuIHN0 cnVjdCBpbnRvIGZyZXNobHkgcGFsbG9jJ2QgbWVtb3J5LgogICovCkBAIC02NzYsOCArNzAx LDE0IEBAIGNoZWNrX3JvbGUoY29uc3QgY2hhciAqcm9sZSwgT2lkIHJvbGVpZCwgTGlzdCAq dG9rZW5zKQogCQkJaWYgKGlzX21lbWJlcihyb2xlaWQsIHRvay0+c3RyaW5nICsgMSkpCiAJ CQkJcmV0dXJuIHRydWU7CiAJCX0KLQkJZWxzZSBpZiAodG9rZW5fbWF0Y2hlcyh0b2ssIHJv bGUpIHx8Ci0JCQkJIHRva2VuX2lzX2tleXdvcmQodG9rLCAiYWxsIikpCisJCWVsc2UgaWYg KHRva2VuX2lzX2tleXdvcmQodG9rLCAiYWxsIikpCisJCQlyZXR1cm4gdHJ1ZTsKKwkJZWxz ZSBpZiAodG9rZW5faGFzX3JlZ2V4cCh0b2spKQorCQl7CisJCQlpZiAocmVnZXhlY19hdXRo X3Rva2VuKHJvbGUsIHRvaywgMCwgTlVMTCkgPT0gUkVHX09LQVkpCisJCQkJcmV0dXJuIHRy dWU7CisJCX0KKwkJZWxzZSBpZiAodG9rZW5fbWF0Y2hlcyh0b2ssIHJvbGUpKQogCQkJcmV0 dXJuIHRydWU7CiAJfQogCXJldHVybiBmYWxzZTsKQEAgLTcxOSw2ICs3NTAsMTEgQEAgY2hl Y2tfZGIoY29uc3QgY2hhciAqZGJuYW1lLCBjb25zdCBjaGFyICpyb2xlLCBPaWQgcm9sZWlk LCBMaXN0ICp0b2tlbnMpCiAJCX0KIAkJZWxzZSBpZiAodG9rZW5faXNfa2V5d29yZCh0b2ss ICJyZXBsaWNhdGlvbiIpKQogCQkJY29udGludWU7CQkJLyogbmV2ZXIgbWF0Y2ggdGhpcyBp ZiBub3Qgd2Fsc2VuZGVyICovCisJCWVsc2UgaWYgKHRva2VuX2hhc19yZWdleHAodG9rKSkK KwkJeworCQkJaWYgKHJlZ2V4ZWNfYXV0aF90b2tlbihkYm5hbWUsIHRvaywgMCwgTlVMTCkg PT0gUkVHX09LQVkpCisJCQkJcmV0dXJuIHRydWU7CisJCX0KIAkJZWxzZSBpZiAodG9rZW5f bWF0Y2hlcyh0b2ssIGRibmFtZSkpCiAJCQlyZXR1cm4gdHJ1ZTsKIAl9CkBAIC0xMTM4LDgg KzExNzQsMTUgQEAgcGFyc2VfaGJhX2xpbmUoVG9rZW5pemVkQXV0aExpbmUgKnRva19saW5l LCBpbnQgZWxldmVsKQogCXRva2VucyA9IGxmaXJzdChmaWVsZCk7CiAJZm9yZWFjaCh0b2tl bmNlbGwsIHRva2VucykKIAl7Ci0JCXBhcnNlZGxpbmUtPmRhdGFiYXNlcyA9IGxhcHBlbmQo cGFyc2VkbGluZS0+ZGF0YWJhc2VzLAotCQkJCQkJCQkJCWNvcHlfYXV0aF90b2tlbihsZmly c3QodG9rZW5jZWxsKSkpOworCQlBdXRoVG9rZW4gICp0b2sgPSBjb3B5X2F1dGhfdG9rZW4o bGZpcnN0KHRva2VuY2VsbCkpOworCisJCS8qCisJCSAqIENvbXBpbGUgYSByZWdleCBmcm9t IHRoZSBkYXRhYmFzZSB0b2tlbiwgaWYgbmVjZXNzYXJ5LgorCQkgKi8KKwkJaWYgKHJlZ2Nv bXBfYXV0aF90b2tlbih0b2ssIEhiYUZpbGVOYW1lLCBsaW5lX251bSwgZXJyX21zZywgZWxl dmVsKSkKKwkJCXJldHVybiBOVUxMOworCisJCXBhcnNlZGxpbmUtPmRhdGFiYXNlcyA9IGxh cHBlbmQocGFyc2VkbGluZS0+ZGF0YWJhc2VzLCB0b2spOwogCX0KIAogCS8qIEdldCB0aGUg cm9sZXMuICovCkBAIC0xMTU4LDggKzEyMDEsMTUgQEAgcGFyc2VfaGJhX2xpbmUoVG9rZW5p emVkQXV0aExpbmUgKnRva19saW5lLCBpbnQgZWxldmVsKQogCXRva2VucyA9IGxmaXJzdChm aWVsZCk7CiAJZm9yZWFjaCh0b2tlbmNlbGwsIHRva2VucykKIAl7Ci0JCXBhcnNlZGxpbmUt PnJvbGVzID0gbGFwcGVuZChwYXJzZWRsaW5lLT5yb2xlcywKLQkJCQkJCQkJCWNvcHlfYXV0 aF90b2tlbihsZmlyc3QodG9rZW5jZWxsKSkpOworCQlBdXRoVG9rZW4gICp0b2sgPSBjb3B5 X2F1dGhfdG9rZW4obGZpcnN0KHRva2VuY2VsbCkpOworCisJCS8qCisJCSAqIENvbXBpbGUg YSByZWdleCBmcm9tIHRoZSByb2xlIHRva2VuLCBpZiBuZWNlc3NhcnkuCisJCSAqLworCQlp ZiAocmVnY29tcF9hdXRoX3Rva2VuKHRvaywgSGJhRmlsZU5hbWUsIGxpbmVfbnVtLCBlcnJf bXNnLCBlbGV2ZWwpKQorCQkJcmV0dXJuIE5VTEw7CisKKwkJcGFyc2VkbGluZS0+cm9sZXMg PSBsYXBwZW5kKHBhcnNlZGxpbmUtPnJvbGVzLCB0b2spOwogCX0KIAogCWlmIChwYXJzZWRs aW5lLT5jb25udHlwZSAhPSBjdExvY2FsKQpAQCAtMjM1NSwxMiArMjQwNSwzMSBAQCBsb2Fk X2hiYSh2b2lkKQogCiAJaWYgKCFvaykKIAl7Ci0JCS8qIEZpbGUgY29udGFpbmVkIG9uZSBv ciBtb3JlIGVycm9ycywgc28gYmFpbCBvdXQgKi8KKwkJLyoKKwkJICogRmlsZSBjb250YWlu ZWQgb25lIG9yIG1vcmUgZXJyb3JzLCBzbyBiYWlsIG91dCwgZmlyc3QgYmVpbmcgY2FyZWZ1 bAorCQkgKiB0byBjbGVhbiB1cCB3aGF0ZXZlciB3ZSBhbGxvY2F0ZWQuICBNb3N0IHN0dWZm IHdpbGwgZ28gYXdheSB2aWEKKwkJICogTWVtb3J5Q29udGV4dERlbGV0ZSwgYnV0IHdlIGhh dmUgdG8gY2xlYW4gdXAgcmVnZXhlcyBleHBsaWNpdGx5LgorCQkgKi8KKwkJZm9yZWFjaChs aW5lLCBuZXdfcGFyc2VkX2xpbmVzKQorCQl7CisJCQlIYmFMaW5lICAgICpuZXdsaW5lID0g KEhiYUxpbmUgKikgbGZpcnN0KGxpbmUpOworCisJCQlmcmVlX2hiYV9saW5lKG5ld2xpbmUp OworCQl9CiAJCU1lbW9yeUNvbnRleHREZWxldGUoaGJhY3h0KTsKIAkJcmV0dXJuIGZhbHNl OwogCX0KIAogCS8qIExvYWRlZCBuZXcgZmlsZSBzdWNjZXNzZnVsbHksIHJlcGxhY2UgdGhl IG9uZSB3ZSB1c2UgKi8KKwlpZiAocGFyc2VkX2hiYV9saW5lcyAhPSBOSUwpCisJeworCQlm b3JlYWNoKGxpbmUsIHBhcnNlZF9oYmFfbGluZXMpCisJCXsKKwkJCUhiYUxpbmUgICAgKm5l d2xpbmUgPSAoSGJhTGluZSAqKSBsZmlyc3QobGluZSk7CisKKwkJCWZyZWVfaGJhX2xpbmUo bmV3bGluZSk7CisJCX0KKwl9CiAJaWYgKHBhcnNlZF9oYmFfY29udGV4dCAhPSBOVUxMKQog CQlNZW1vcnlDb250ZXh0RGVsZXRlKHBhcnNlZF9oYmFfY29udGV4dCk7CiAJcGFyc2VkX2hi YV9jb250ZXh0ID0gaGJhY3h0OwpkaWZmIC0tZ2l0IGEvc3JjL3Rlc3QvYXV0aGVudGljYXRp b24vdC8wMDFfcGFzc3dvcmQucGwgYi9zcmMvdGVzdC9hdXRoZW50aWNhdGlvbi90LzAwMV9w YXNzd29yZC5wbAppbmRleCBlYTY2NGQxOGY1Li5hY2I4YmZhYWM4IDEwMDY0NAotLS0gYS9z cmMvdGVzdC9hdXRoZW50aWNhdGlvbi90LzAwMV9wYXNzd29yZC5wbAorKysgYi9zcmMvdGVz dC9hdXRoZW50aWNhdGlvbi90LzAwMV9wYXNzd29yZC5wbApAQCAtODEsNiArODEsMTQgQEAg JG5vZGUtPnNhZmVfcHNxbCgKIAkgR1JBTlQgQUxMIE9OIHN5c3VzZXJfZGF0YSBUTyBtZDVf cm9sZTsiKTsKICRFTlZ7IlBHUEFTU1dPUkQifSA9ICdwYXNzJzsKIAorIyBDcmVhdGUgYSBy b2xlIHRoYXQgY29udGFpbnMgYSBjb21tYSB0byBzdHJlc3MgdGhlIHBhcnNpbmcuCiskbm9k ZS0+c2FmZV9wc3FsKCdwb3N0Z3JlcycsCisJcXtTRVQgcGFzc3dvcmRfZW5jcnlwdGlvbj0n bWQ1JzsgQ1JFQVRFIFJPTEUgIm1kNSxyb2xlIiBMT0dJTiBQQVNTV09SRCAncGFzcyc7fQor KTsKKworIyBDcmVhdGUgYSBkYXRhYmFzZSB0byB0ZXN0IHJlZ3VsYXIgZXhwcmVzc2lvbi4K KyRub2RlLT5zYWZlX3BzcWwoJ3Bvc3RncmVzJywgIkNSRUFURSBkYXRhYmFzZSByZWdleF90 ZXN0ZGI7Iik7CisKICMgRm9yICJ0cnVzdCIgbWV0aG9kLCBhbGwgdXNlcnMgc2hvdWxkIGJl IGFibGUgdG8gY29ubmVjdC4gVGhlc2UgdXNlcnMgYXJlIG5vdAogIyBjb25zaWRlcmVkIHRv IGJlIGF1dGhlbnRpY2F0ZWQuCiByZXNldF9wZ19oYmEoJG5vZGUsICdhbGwnLCAnYWxsJywg J3RydXN0Jyk7CkBAIC0yMDAsNiArMjA4LDM5IEBAIGFwcGVuZF90b19maWxlKAogCiB0ZXN0 X2Nvbm4oJG5vZGUsICd1c2VyPW1kNV9yb2xlJywgJ3Bhc3N3b3JkIGZyb20gcGdwYXNzJywg MCk7CiAKKyMgVGVzdGluZyB3aXRoIHJlZ3VsYXIgZXhwcmVzc2lvbiBmb3IgdXNlcm5hbWUu IE5vdGUgdGhhdCB0aGUgdGhpcmQgcmVnZXgKKyMgbWF0Y2hlcyBpbiB0aGlzIGNhc2UuCity ZXNldF9wZ19oYmEoJG5vZGUsICdhbGwnLCAnL14uKm5vbWF0Y2guKiQsIGJhZHVzZXIsIC9e bWQuKiQnLCAncGFzc3dvcmQnKTsKK3Rlc3RfY29ubigkbm9kZSwgJ3VzZXI9bWQ1X3JvbGUn LCAncGFzc3dvcmQsIG1hdGNoaW5nIHJlZ2V4cCBmb3IgdXNlcm5hbWUnLAorCTApOworCisj IFRoZSB0aGlyZCByZWdleCBkb2VzIG5vdCBtYXRjaCBhbnltb3JlLgorcmVzZXRfcGdfaGJh KCRub2RlLCAnYWxsJywgJy9eLipub21hdGNoLiokLCBiYWR1c2VyLCAvXm1fZC4qJCcsICdw YXNzd29yZCcpOwordGVzdF9jb25uKCRub2RlLCAndXNlcj1tZDVfcm9sZScsCisJJ3Bhc3N3 b3JkLCBub24gbWF0Y2hpbmcgcmVnZXhwIGZvciB1c2VybmFtZScsCisJMiwgbG9nX3VubGlr ZSA9PiBbcXIvY29ubmVjdGlvbiBhdXRoZW50aWNhdGVkOi9dKTsKKworIyBUZXN0IHdpdGgg YSBjb21tYSBpbiB0aGUgcmVndWxhciBleHByZXNzaW9uCityZXNldF9wZ19oYmEoJG5vZGUs ICdhbGwnLCAnIi9eLio1LC4qZSQiJywgJ3Bhc3N3b3JkJyk7Cit0ZXN0X2Nvbm4oJG5vZGUs ICd1c2VyPW1kNSxyb2xlJywgJ3Bhc3N3b3JkJywgJ21hdGNoaW5nIHJlZ2V4cCBmb3IgdXNl cm5hbWUnLAorCTApOworCisjIFRlc3Rpbmcgd2l0aCByZWd1bGFyIGV4cHJlc3Npb24gZm9y IGRibmFtZS4gVGhlIHRoaXJkIHJlZ2V4IG1hdGNoZXMuCityZXNldF9wZ19oYmEoJG5vZGUs ICcvXi4qbm9tYXRjaC4qJCwgYmFkZGIsIC9ecmVnZXhfdC4qYiQnLCAnYWxsJywKKwkncGFz c3dvcmQnKTsKK3Rlc3RfY29ubigKKwkkbm9kZSwgJ3VzZXI9bWQ1X3JvbGUgZGJuYW1lPXJl Z2V4X3Rlc3RkYicsICdwYXNzd29yZCwKKyAgIG1hdGNoaW5nIHJlZ2V4cCBmb3IgZGJuYW1l JywgMCk7CisKKyMgVGhlIHRoaXJkIHJlZ2V4IGRvZXMgbm90IG1hdGNoIGFueW1vcmUuCity ZXNldF9wZ19oYmEoJG5vZGUsICcvXi4qbm9tYXRjaC4qJCwgYmFkZGIsIC9ecmVnZXhfdC4q YmEkJywKKwknYWxsJywgJ3Bhc3N3b3JkJyk7Cit0ZXN0X2Nvbm4oCisJJG5vZGUsCisJJ3Vz ZXI9bWQ1X3JvbGUgZGJuYW1lPXJlZ2V4X3Rlc3RkYicsCisJJ3Bhc3N3b3JkLCBub24gbWF0 Y2hpbmcgcmVnZXhwIGZvciBkYm5hbWUnLAorCTIsIGxvZ191bmxpa2UgPT4gW3FyL2Nvbm5l Y3Rpb24gYXV0aGVudGljYXRlZDovXSk7CisKIHVubGluaygkcGdwYXNzZmlsZSk7CiBkZWxl dGUgJEVOVnsiUEdQQVNTRklMRSJ9OwogCg== --------------oS4YfKTv14upNARabBagJ0ob--