Message-ID: <75b0dbb55e9febea54c441efff8012a6d2cb5bd7.camel@j-davis.com>
Subject: Blocking execution of SECURITY INVOKER
From: Jeff Davis <pgsql@j-davis.com>
To: pgsql-hackers@postgresql.org
Date: Wed, 11 Jan 2023 18:16:32 -0800
Content-Type: multipart/mixed; boundary="=-WzA4PEPRBY+onHaIB3dO"
User-Agent: Evolution 3.44.4-0ubuntu1 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/75b0dbb55e9febea54c441efff8012a6d2cb5bd7.camel%40j-davis.com>
Precedence: bulk

--=-WzA4PEPRBY+onHaIB3dO
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Motivation
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

SECURITY INVOKER is dangerous, particularly for administrators. There
are numerous ways to put code in a place that's likely to be executed:
triggers, views calling functions, logically-replicated tables, casts,
search path and function resolution tricks, etc. If this code is run
with the privileges of the invoker, then it provides an easy path to
privilege escalation.

We've addressed some of these risks, i.e. by offering better ways to
control the search path, and by ignoring SECURITY INVOKER in some
contexts (like maintenance commands). But it still leaves a lot of
risks for administrators who want to do a SELECT or INSERT. And it
limits major use cases, like logical replication (where the
subscription owner must trust all table owners).

Note that, in the SQL spec, SECURITY DEFINER is the default, which may
be due to some of the dangers of SECURITY INVOKER. (SECURITY DEFINER
carries its own risks, of course, especially if the definer is highly
privileged.)

Prior work
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

https://www.postgresql.org/message-id/19327.1533748538%40sss.pgh.pa.us

The above thread came up with a couple solutions to express a trust
relationship between users (via GUC or DDL). I'm happy if that
discussion continues, but it appeared to trail off.

My new proposal is different (and simpler, I believe) in two ways:

First, my proposal is only concerned with SECURITY INVOKER functions
and executing arbitrary code written by untrusted users. There's still
the potential for mischief without using SECURITY INVOKER (e.g. if the
search path isn't properly controlled), but it's a different kind of
problem. This narrower problem scope makes my proposal less invasive.

Second, my proposal doesn't establish a new trust relationship. If the
SECURITY INVOKER function is owned by a user that can SET ROLE to you,
you trust it; otherwise not.=20

Proposal
=3D=3D=3D=3D=3D=3D=3D=3D

New boolean GUC check_function_owner_trust, default false.

If check_function_owner_trust=3Dtrue, throw an error if you try to
execute a function that is SECURITY INVOKER and owned by a user other
than you or someone that can SET ROLE to you.

Use Cases
=3D=3D=3D=3D=3D=3D=3D=3D=3D

1. If you are a superuser/admin working on a problem interactively, you
can protect yourself against accidentally executing malicious code with
your privileges.

2. You can set up logical replication subscriptions into tables owned
by users you don't trust, as long as triggers (if needed) can be safely
written as SECURITY DEFINER.

3. You can ensure that running an extension script doesn't somehow
execute malicious code with superuser privileges.

4. Users can protect themselves from executing malicious code in cases
where:
  a. role membership accurately describes the trust relationship
already
  b. triggers, views-calling-UDFs, etc., (if any) can be safely written
as SECURITY DEFINER

While that may not be every conceivable use case, it feels very useful
to me.

Even if you really don't like SECURITY DEFINER, points 1, 3, and 4(a)
seem like wins. And there are a lot of cases where the user simply
doesn't need triggers (etc.).

Extensions
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Some extensions might create and extension-specific user that owns lots
of SECURITY INVOKER functions. If this GUC is set, other users wouldn't
be able to call those functions.

Our contrib extensions don't seem do that, and all the tests for them
pass without modification (even when the GUC is true).

For extensions that do create extension-specific users that own
SECURITY INVOKER functions, this GUC alone won't work. Trying to
capture that use case as well could involve more discussion (involving
extension authors) and may result in an extension-specific trust
proposal, so I'm considering that out of scope.

Loose Ends
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Do we need to check security-invoker views? I don't think it's nearly
as important, because views can't write data. A security-invoker view
read from a security definer function uses the privileges of the
function owner, so I don't see an obvious way to abuse a security
invoker view, but perhaps I'm not creative enough.

Also, Noah's patch did things differently from mine in a few places,
and I need to work out whether I missed something. I may have to add a
check for the range types "subtype_diff" function, for instance.

Future Work
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

In some cases, we should consider defaulting (or even forcing) this GUC
to be true, such as in a subscription apply worker.

This proposal may offer a path to allowing non-superusers to create
event triggers.

We may want to provide SECURITY PUBLIC or SECURITY NONE (or even
"SECURITY AS <role>"?), which would execute a function with minimal
privileges, and further reduce the need for executing untrusted
SECURITY INVOKER code.

Another idea is to have READ ONLY functions which would be another way
to make SECURITY INVOKER safer.

--=20
Jeff Davis
PostgreSQL Contributor Team - AWS


--=-WzA4PEPRBY+onHaIB3dO
Content-Disposition: attachment;
	filename="v1-0001-Introduce-GUC-check_function_owner_trust.patch"
Content-Type: text/x-patch;
	name="v1-0001-Introduce-GUC-check_function_owner_trust.patch";
	charset="UTF-8"
Content-Transfer-Encoding: base64

RnJvbSAxYjRiNTc1MDE3YTIyNjAxMWU2YTAxNzRjMGE0YzM3MjAxNWZhYTA2IE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBKZWZmIERhdmlzIDxqZWZmQGotZGF2aXMuY29tPgpEYXRlOiBX
ZWQsIDExIEphbiAyMDIzIDE1OjMzOjQ3IC0wODAwClN1YmplY3Q6IFtQQVRDSCB2MV0gSW50cm9k
dWNlIEdVQyBjaGVja19mdW5jdGlvbl9vd25lcl90cnVzdC4KCklmIHNldCB0byB0cnVlLCBibG9j
a3MgZXhlY3V0aW9uIG9mIFNFQ1VSSVRZIElOVk9LRVIgZnVuY3Rpb25zIHVubGVzcwp0aGUgZnVu
Y3Rpb24gb3duZXIgY2FuIFNFVCBST0xFIHRvIHRoZSBjdXJyZW50IHVzZXIuCi0tLQogZG9jL3Ny
Yy9zZ21sL2NvbmZpZy5zZ21sICAgICAgICAgICAgICAgICAgICAgIHwgMjYgKysrKysrCiBzcmMv
YmFja2VuZC9jYXRhbG9nL2FjbGNoay5jICAgICAgICAgICAgICAgICAgfCAxMyArKysKIHNyYy9i
YWNrZW5kL29wdGltaXplci91dGlsL2NsYXVzZXMuYyAgICAgICAgICB8ICAyICsKIHNyYy9iYWNr
ZW5kL3V0aWxzL2ZtZ3IvZm1nci5jICAgICAgICAgICAgICAgICB8IDEwICsrKwogc3JjL2JhY2tl
bmQvdXRpbHMvbWlzYy9ndWNfdGFibGVzLmMgICAgICAgICAgIHwgMTAgKysrCiBzcmMvYmFja2Vu
ZC91dGlscy9taXNjL3Bvc3RncmVzcWwuY29uZi5zYW1wbGUgfCAgMSArCiBzcmMvaW5jbHVkZS91
dGlscy9hY2wuaCAgICAgICAgICAgICAgICAgICAgICAgfCAgMSArCiBzcmMvaW5jbHVkZS91dGls
cy9ndWMuaCAgICAgICAgICAgICAgICAgICAgICAgfCAgMSArCiBzcmMvdGVzdC9yZWdyZXNzL2V4
cGVjdGVkL3ByaXZpbGVnZXMub3V0ICAgICAgfCA4NSArKysrKysrKysrKysrKysrKysrCiBzcmMv
dGVzdC9yZWdyZXNzL3NxbC9wcml2aWxlZ2VzLnNxbCAgICAgICAgICAgfCA1NyArKysrKysrKysr
KysrCiAxMCBmaWxlcyBjaGFuZ2VkLCAyMDYgaW5zZXJ0aW9ucygrKQoKZGlmZiAtLWdpdCBhL2Rv
Yy9zcmMvc2dtbC9jb25maWcuc2dtbCBiL2RvYy9zcmMvc2dtbC9jb25maWcuc2dtbAppbmRleCAy
ZmVjNjEzNDg0Li5mZGZiNzMyYTZlIDEwMDY0NAotLS0gYS9kb2Mvc3JjL3NnbWwvY29uZmlnLnNn
bWwKKysrIGIvZG9jL3NyYy9zZ21sL2NvbmZpZy5zZ21sCkBAIC04NzA3LDYgKzg3MDcsMzIgQEAg
Q09QWSBwb3N0Z3Jlc19sb2cgRlJPTSAnL2Z1bGwvcGF0aC90by9sb2dmaWxlLmNzdicgV0lUSCBj
c3Y7CiAgICAgICA8L2xpc3RpdGVtPgogICAgICA8L3Zhcmxpc3RlbnRyeT4KIAorICAgICA8dmFy
bGlzdGVudHJ5IGlkPSJndWMtY2hlY2stZnVuY3Rpb24tb3duZXItdHJ1c3QiIHhyZWZsYWJlbD0i
Y2hlY2tfZnVuY3Rpb25fb3duZXJfdHJ1c3QiPgorICAgICAgPHRlcm0+PHZhcm5hbWU+Y2hlY2tf
ZnVuY3Rpb25fb3duZXJfdHJ1c3Q8L3Zhcm5hbWU+ICg8dHlwZT5ib29sZWFuPC90eXBlPikKKyAg
ICAgIDxpbmRleHRlcm0+CisgICAgICAgPHByaW1hcnk+PHZhcm5hbWU+Y2hlY2tfZnVuY3Rpb25f
b3duZXJfdHJ1c3Q8L3Zhcm5hbWU+IGNvbmZpZ3VyYXRpb24gcGFyYW1ldGVyPC9wcmltYXJ5Pgor
ICAgICAgPC9pbmRleHRlcm0+CisgICAgICA8L3Rlcm0+CisgICAgICA8bGlzdGl0ZW0+CisgICAg
ICAgPHBhcmE+CisgICAgICAgIFRoaXMgdmFyaWFibGUgY29udHJvbHMgd2hldGhlciB0byByYWlz
ZSBhbiBlcnJvciBpbiBsaWV1IG9mIGV4ZWN1dGluZworICAgICAgICBhIDxsaXRlcmFsPlNFQ1VS
SVRZIElOVk9LRVI8L2xpdGVyYWw+IGZ1bmN0aW9uIChzZWUgPHhyZWYKKyAgICAgICAgbGlua2Vu
ZD0ic3FsLWNyZWF0ZWZ1bmN0aW9uIi8+KSB3aGVuIHRoYXQgZnVuY3Rpb24gaXMgb3duZWQgYnkg
YW4KKyAgICAgICAgdW50cnVzdGVkIHVzZXIuIFdoZW4gc2V0IHRvIDxsaXRlcmFsPm9mZjwvbGl0
ZXJhbD4gKHRoZSBkZWZhdWx0KSwKKyAgICAgICAgZnVuY3Rpb25zIGFyZSBleGVjdXRlZCBub3Jt
YWxseSByZWdhcmRsZXNzIG9mIHRoZSBvd25lci4gV2hlbiBzZXQgdG8KKyAgICAgICAgPGxpdGVy
YWw+b248L2xpdGVyYWw+LCBhbiBlcnJvciBpcyByYWlzZWQgdW5sZXNzIHRoZSA8bGl0ZXJhbD5T
RUNVUklUWQorICAgICAgICBJTlZPS0VSPC9saXRlcmFsPiBmdW5jdGlvbiBpcyBvd25lZCBieSB0
aGUgY3VycmVudCB1c2VyLCBvciBhIHVzZXIKKyAgICAgICAgdGhhdCBjYW4gPHhyZWYgbGlua2Vu
ZD0ic3FsLXNldC1yb2xlIi8+IHRvIHRoZSBjdXJyZW50IHVzZXIuCisgICAgICAgPC9wYXJhPgor
CisgICAgICAgPHBhcmE+CisgICAgICAgIFNldHRpbmcgdGhpcyB2YXJpYWJsZSB0byA8bGl0ZXJh
bD5vbjwvbGl0ZXJhbD4gcHJvdmlkZXMgcHJvdGVjdGlvbgorICAgICAgICBhZ2FpbnN0IHVuZXhw
ZWN0ZWRseSBleGVjdXRpbmcgY29kZSB3cml0dGVuIGJ5IGFub3RoZXIgdXNlciwgZS5nLiBkdWUK
KyAgICAgICAgdG8gYSB0cmlnZ2VyICg8eHJlZiBsaW5rZW5kPSJ0cmlnZ2VycyIvPikuCisgICAg
ICAgPC9wYXJhPgorICAgICAgPC9saXN0aXRlbT4KKyAgICAgPC92YXJsaXN0ZW50cnk+CisKICAg
ICAgPHZhcmxpc3RlbnRyeSBpZD0iZ3VjLWRlZmF1bHQtdGFibGUtYWNjZXNzLW1ldGhvZCIgeHJl
ZmxhYmVsPSJkZWZhdWx0X3RhYmxlX2FjY2Vzc19tZXRob2QiPgogICAgICAgPHRlcm0+PHZhcm5h
bWU+ZGVmYXVsdF90YWJsZV9hY2Nlc3NfbWV0aG9kPC92YXJuYW1lPiAoPHR5cGU+c3RyaW5nPC90
eXBlPikKICAgICAgIDxpbmRleHRlcm0+CmRpZmYgLS1naXQgYS9zcmMvYmFja2VuZC9jYXRhbG9n
L2FjbGNoay5jIGIvc3JjL2JhY2tlbmQvY2F0YWxvZy9hY2xjaGsuYwppbmRleCBjYzZlMjYwOTA4
Li43MzRjOTVhM2Y0IDEwMDY0NAotLS0gYS9zcmMvYmFja2VuZC9jYXRhbG9nL2FjbGNoay5jCisr
KyBiL3NyYy9iYWNrZW5kL2NhdGFsb2cvYWNsY2hrLmMKQEAgLTM5NzcsNiArMzk3NywxOSBAQCBw
Z19sYXJnZW9iamVjdF9hY2xjaGVja19zbmFwc2hvdChPaWQgbG9ial9vaWQsIE9pZCByb2xlaWQs
IEFjbE1vZGUgbW9kZSwKIAkJcmV0dXJuIEFDTENIRUNLX05PX1BSSVY7CiB9CiAKKy8qCisgKiBG
b3IgU0VDVVJJVFkgSU5WT0tFUiBmdW5jdGlvbnMsIGNoZWNrIHRoYXQgdGhlIGNhbGxpbmcgdXNl
ciB0cnVzdHMgdGhlCisgKiBmdW5jdGlvbiBvd25lciBlbm91Z2ggdG8gcnVuIHRoZSBjb2RlLgor
ICovCitib29sCitmdW5jdGlvbl9vd25lcl90cnVzdChPaWQgcHJvb3duZXIpCit7CisJaWYgKCFj
aGVja19mdW5jdGlvbl9vd25lcl90cnVzdCkKKwkJcmV0dXJuIHRydWU7CisKKwlyZXR1cm4gbWVt
YmVyX2Nhbl9zZXRfcm9sZShwcm9vd25lciwgR2V0VXNlcklkKCkpOworfQorCiAvKgogICogR2Vu
ZXJpYyBvd25lcnNoaXAgY2hlY2sgZm9yIGFuIG9iamVjdAogICovCmRpZmYgLS1naXQgYS9zcmMv
YmFja2VuZC9vcHRpbWl6ZXIvdXRpbC9jbGF1c2VzLmMgYi9zcmMvYmFja2VuZC9vcHRpbWl6ZXIv
dXRpbC9jbGF1c2VzLmMKaW5kZXggYWE1ODQ4NDhjZi4uOTY3OGY1NTA1MiAxMDA2NDQKLS0tIGEv
c3JjL2JhY2tlbmQvb3B0aW1pemVyL3V0aWwvY2xhdXNlcy5jCisrKyBiL3NyYy9iYWNrZW5kL29w
dGltaXplci91dGlsL2NsYXVzZXMuYwpAQCAtNDQxMiw2ICs0NDEyLDcgQEAgaW5saW5lX2Z1bmN0
aW9uKE9pZCBmdW5jaWQsIE9pZCByZXN1bHRfdHlwZSwgT2lkIHJlc3VsdF9jb2xsaWQsCiAJCWZ1
bmNmb3JtLT5wcm9raW5kICE9IFBST0tJTkRfRlVOQ1RJT04gfHwKIAkJZnVuY2Zvcm0tPnByb3Nl
Y2RlZiB8fAogCQlmdW5jZm9ybS0+cHJvcmV0c2V0IHx8CisJCSFmdW5jdGlvbl9vd25lcl90cnVz
dChmdW5jZm9ybS0+cHJvb3duZXIpIHx8CiAJCWZ1bmNmb3JtLT5wcm9yZXR0eXBlID09IFJFQ09S
RE9JRCB8fAogCQkhaGVhcF9hdHRpc251bGwoZnVuY190dXBsZSwgQW51bV9wZ19wcm9jX3Byb2Nv
bmZpZywgTlVMTCkgfHwKIAkJZnVuY2Zvcm0tPnByb25hcmdzICE9IGxpc3RfbGVuZ3RoKGFyZ3Mp
KQpAQCAtNDk5Niw2ICs0OTk3LDcgQEAgaW5saW5lX3NldF9yZXR1cm5pbmdfZnVuY3Rpb24oUGxh
bm5lckluZm8gKnJvb3QsIFJhbmdlVGJsRW50cnkgKnJ0ZSkKIAkJZnVuY2Zvcm0tPnByb3JldHR5
cGUgPT0gVk9JRE9JRCB8fAogCQlmdW5jZm9ybS0+cHJvc2VjZGVmIHx8CiAJCSFmdW5jZm9ybS0+
cHJvcmV0c2V0IHx8CisJCSFmdW5jdGlvbl9vd25lcl90cnVzdChmdW5jZm9ybS0+cHJvb3duZXIp
IHx8CiAJCWxpc3RfbGVuZ3RoKGZleHByLT5hcmdzKSAhPSBmdW5jZm9ybS0+cHJvbmFyZ3MgfHwK
IAkJIWhlYXBfYXR0aXNudWxsKGZ1bmNfdHVwbGUsIEFudW1fcGdfcHJvY19wcm9jb25maWcsIE5V
TEwpKQogCXsKZGlmZiAtLWdpdCBhL3NyYy9iYWNrZW5kL3V0aWxzL2ZtZ3IvZm1nci5jIGIvc3Jj
L2JhY2tlbmQvdXRpbHMvZm1nci9mbWdyLmMKaW5kZXggM2Y2NDE2MTc2MC4uMzk4NWY0MjI5MCAx
MDA2NDQKLS0tIGEvc3JjL2JhY2tlbmQvdXRpbHMvZm1nci9mbWdyLmMKKysrIGIvc3JjL2JhY2tl
bmQvdXRpbHMvZm1nci9mbWdyLmMKQEAgLTIxNCw2ICsyMTQsMTYgQEAgZm1ncl9pbmZvX2N4dF9z
ZWN1cml0eShPaWQgZnVuY3Rpb25JZCwgRm1nckluZm8gKmZpbmZvLCBNZW1vcnlDb250ZXh0IG1j
eHQsCiAJCXJldHVybjsKIAl9CiAKKwkvKiBTRUNVUklUWSBJTlZPS0VSOyBjaGVjayB0aGF0IHdl
IHRydXN0IHRoZSBmdW5jdGlvbiBvd25lciAqLworCWlmICghaWdub3JlX3NlY3VyaXR5ICYmICFm
dW5jdGlvbl9vd25lcl90cnVzdChwcm9jZWR1cmVTdHJ1Y3QtPnByb293bmVyKSkKKwkJZXJlcG9y
dChFUlJPUiwKKwkJCQkoZXJybXNnKCJjYW5ub3QgZXhlY3V0ZSBmdW5jdGlvbiAlcyBvd25lZCBi
eSB1bnRydXN0ZWQgdXNlciAlcyIsCisJCQkJCQlOYW1lU3RyKHByb2NlZHVyZVN0cnVjdC0+cHJv
bmFtZSksCisJCQkJCQlHZXRVc2VyTmFtZUZyb21JZChwcm9jZWR1cmVTdHJ1Y3QtPnByb293bmVy
LCBmYWxzZSkpLAorCQkJCSBlcnJkZXRhaWwoIldoZW4gY2hlY2tfZnVuY3Rpb25fb3duZXJfdHJ1
c3QgaXMgb24sICIKKwkJCQkJCSAgICJTRUNVUklUWSBJTlZPS0VSIGZ1bmN0aW9ucyBtdXN0IGJl
IG93bmVkIGJ5ICIKKwkJCQkJCSAgICJhIHJvbGUgdGhhdCBjYW4gU0VUIFJPTEUgdG8gdGhlIGNh
bGxpbmcgdXNlci4iKSkpOworCiAJc3dpdGNoIChwcm9jZWR1cmVTdHJ1Y3QtPnByb2xhbmcpCiAJ
ewogCQljYXNlIElOVEVSTkFMbGFuZ3VhZ2VJZDoKZGlmZiAtLWdpdCBhL3NyYy9iYWNrZW5kL3V0
aWxzL21pc2MvZ3VjX3RhYmxlcy5jIGIvc3JjL2JhY2tlbmQvdXRpbHMvbWlzYy9ndWNfdGFibGVz
LmMKaW5kZXggOTI1NDViNDk1OC4uNWE5OWI2NmZkYyAxMDA2NDQKLS0tIGEvc3JjL2JhY2tlbmQv
dXRpbHMvbWlzYy9ndWNfdGFibGVzLmMKKysrIGIvc3JjL2JhY2tlbmQvdXRpbHMvbWlzYy9ndWNf
dGFibGVzLmMKQEAgLTQ3OSw2ICs0NzksNyBAQCBib29sCQlsb2dfYnRyZWVfYnVpbGRfc3RhdHMg
PSBmYWxzZTsKIGNoYXIJICAgKmV2ZW50X3NvdXJjZTsKIAogYm9vbAkJcm93X3NlY3VyaXR5Owor
Ym9vbAkJY2hlY2tfZnVuY3Rpb25fb3duZXJfdHJ1c3QgPSBmYWxzZTsKIGJvb2wJCWNoZWNrX2Z1
bmN0aW9uX2JvZGllcyA9IHRydWU7CiAKIC8qCkBAIC0xNTc2LDYgKzE1NzcsMTUgQEAgc3RydWN0
IGNvbmZpZ19ib29sIENvbmZpZ3VyZU5hbWVzQm9vbFtdID0KIAkJdHJ1ZSwKIAkJTlVMTCwgTlVM
TCwgTlVMTAogCX0sCisJeworCQl7ImNoZWNrX2Z1bmN0aW9uX293bmVyX3RydXN0IiwgUEdDX1VT
RVJTRVQsIENMSUVOVF9DT05OX1NUQVRFTUVOVCwKKwkJCWdldHRleHRfbm9vcCgiQ2hlY2sgdGhh
dCBhIFNFQ1VSSVRZIElOVk9LRVIgZnVuY3Rpb24ncyBvd25lciBpcyB0cnVzdGVkIGJlZm9yZSBl
eGVjdXRpbmcuIiksCisJCQlOVUxMCisJCX0sCisJCSZjaGVja19mdW5jdGlvbl9vd25lcl90cnVz
dCwKKwkJZmFsc2UsCisJCU5VTEwsIE5VTEwsIE5VTEwKKwl9LAogCXsKIAkJeyJjaGVja19mdW5j
dGlvbl9ib2RpZXMiLCBQR0NfVVNFUlNFVCwgQ0xJRU5UX0NPTk5fU1RBVEVNRU5ULAogCQkJZ2V0
dGV4dF9ub29wKCJDaGVjayByb3V0aW5lIGJvZGllcyBkdXJpbmcgQ1JFQVRFIEZVTkNUSU9OIGFu
ZCBDUkVBVEUgUFJPQ0VEVVJFLiIpLApkaWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQvdXRpbHMvbWlz
Yy9wb3N0Z3Jlc3FsLmNvbmYuc2FtcGxlIGIvc3JjL2JhY2tlbmQvdXRpbHMvbWlzYy9wb3N0Z3Jl
c3FsLmNvbmYuc2FtcGxlCmluZGV4IGMyYWRhOTIwNTQuLmYzN2E5YzNiYmEgMTAwNjQ0Ci0tLSBh
L3NyYy9iYWNrZW5kL3V0aWxzL21pc2MvcG9zdGdyZXNxbC5jb25mLnNhbXBsZQorKysgYi9zcmMv
YmFja2VuZC91dGlscy9taXNjL3Bvc3RncmVzcWwuY29uZi5zYW1wbGUKQEAgLTY4NCw2ICs2ODQs
NyBAQAogI2RlZmF1bHRfdG9hc3RfY29tcHJlc3Npb24gPSAncGdseicJIyAncGdseicgb3IgJ2x6
NCcKICN0ZW1wX3RhYmxlc3BhY2VzID0gJycJCQkjIGEgbGlzdCBvZiB0YWJsZXNwYWNlIG5hbWVz
LCAnJyB1c2VzCiAJCQkJCSMgb25seSBkZWZhdWx0IHRhYmxlc3BhY2UKKyNjaGVja19mdW5jdGlv
bl9vd25lcl90cnVzdCA9IG9mZgogI2NoZWNrX2Z1bmN0aW9uX2JvZGllcyA9IG9uCiAjZGVmYXVs
dF90cmFuc2FjdGlvbl9pc29sYXRpb24gPSAncmVhZCBjb21taXR0ZWQnCiAjZGVmYXVsdF90cmFu
c2FjdGlvbl9yZWFkX29ubHkgPSBvZmYKZGlmZiAtLWdpdCBhL3NyYy9pbmNsdWRlL3V0aWxzL2Fj
bC5oIGIvc3JjL2luY2x1ZGUvdXRpbHMvYWNsLmgKaW5kZXggZjhlMTIzOGZhMi4uODdiNzc1MDQx
YSAxMDA2NDQKLS0tIGEvc3JjL2luY2x1ZGUvdXRpbHMvYWNsLmgKKysrIGIvc3JjL2luY2x1ZGUv
dXRpbHMvYWNsLmgKQEAgLTI1OCw2ICsyNTgsNyBAQCBleHRlcm4gQWNsUmVzdWx0IHBnX3BhcmFt
ZXRlcl9hY2xjaGVjayhjb25zdCBjaGFyICpuYW1lLCBPaWQgcm9sZWlkLAogCQkJCQkJCQkJICAg
QWNsTW9kZSBtb2RlKTsKIGV4dGVybiBBY2xSZXN1bHQgcGdfbGFyZ2VvYmplY3RfYWNsY2hlY2tf
c25hcHNob3QoT2lkIGxvYmpfb2lkLCBPaWQgcm9sZWlkLAogCQkJCQkJCQkJCQkJICBBY2xNb2Rl
IG1vZGUsIFNuYXBzaG90IHNuYXBzaG90KTsKK2V4dGVybiBib29sIGZ1bmN0aW9uX293bmVyX3Ry
dXN0KE9pZCBwcm9vd25lcik7CiAKIGV4dGVybiB2b2lkIGFjbGNoZWNrX2Vycm9yKEFjbFJlc3Vs
dCBhY2xlcnIsIE9iamVjdFR5cGUgb2JqdHlwZSwKIAkJCQkJCSAgIGNvbnN0IGNoYXIgKm9iamVj
dG5hbWUpOwpkaWZmIC0tZ2l0IGEvc3JjL2luY2x1ZGUvdXRpbHMvZ3VjLmggYi9zcmMvaW5jbHVk
ZS91dGlscy9ndWMuaAppbmRleCBiYTg5ZDAxM2U2Li5jZDIxMGY1ZmNjIDEwMDY0NAotLS0gYS9z
cmMvaW5jbHVkZS91dGlscy9ndWMuaAorKysgYi9zcmMvaW5jbHVkZS91dGlscy9ndWMuaApAQCAt
MjQ5LDYgKzI0OSw3IEBAIGV4dGVybiBQR0RMTElNUE9SVCBib29sIGxvZ19leGVjdXRvcl9zdGF0
czsKIGV4dGVybiBQR0RMTElNUE9SVCBib29sIGxvZ19zdGF0ZW1lbnRfc3RhdHM7CiBleHRlcm4g
UEdETExJTVBPUlQgYm9vbCBsb2dfYnRyZWVfYnVpbGRfc3RhdHM7CiAKK2V4dGVybiBQR0RMTElN
UE9SVCBib29sIGNoZWNrX2Z1bmN0aW9uX293bmVyX3RydXN0OwogZXh0ZXJuIFBHRExMSU1QT1JU
IGJvb2wgY2hlY2tfZnVuY3Rpb25fYm9kaWVzOwogZXh0ZXJuIFBHRExMSU1QT1JUIGJvb2wgc2Vz
c2lvbl9hdXRoX2lzX3N1cGVydXNlcjsKIApkaWZmIC0tZ2l0IGEvc3JjL3Rlc3QvcmVncmVzcy9l
eHBlY3RlZC9wcml2aWxlZ2VzLm91dCBiL3NyYy90ZXN0L3JlZ3Jlc3MvZXhwZWN0ZWQvcHJpdmls
ZWdlcy5vdXQKaW5kZXggMzRjMjZhODA0YS4uNWRhZmJkZWJiNSAxMDA2NDQKLS0tIGEvc3JjL3Rl
c3QvcmVncmVzcy9leHBlY3RlZC9wcml2aWxlZ2VzLm91dAorKysgYi9zcmMvdGVzdC9yZWdyZXNz
L2V4cGVjdGVkL3ByaXZpbGVnZXMub3V0CkBAIC0zNTksNiArMzU5LDkxIEBAIFNFTEVDVCAqIEZS
T00gYXRlc3QxOyAtLSBvawogIDEgfCB0d28KICgyIHJvd3MpCiAKKy0tIHRlc3QgdGhhdCB3ZSB0
cnVzdCB0aGUgb3duZXIgb2YgU0VDVVJJVFkgSU5WT0tFUiBmdW5jdGlvbnMKK1JFU0VUIFNFU1NJ
T04gQVVUSE9SSVpBVElPTjsKK0dSQU5UIHJlZ3Jlc3NfcHJpdl91c2VyMSBUTyByZWdyZXNzX3By
aXZfdXNlcjI7CitTRVQgU0VTU0lPTiBBVVRIT1JJWkFUSU9OIHJlZ3Jlc3NfcHJpdl91c2VyMjsK
K0NSRUFURSBGVU5DVElPTiB0ZXN0Zl90cnVzdDEoKSBSRVRVUk5TIElOVCBTRUNVUklUWSBJTlZP
S0VSCisgIExBTkdVQUdFIHNxbCBBUyAkJCBTRUxFQ1QgNDIgJCQ7CitDUkVBVEUgRlVOQ1RJT04g
dGVzdGZfdHJ1c3QyKCkgUkVUVVJOUyBJTlQgU0VDVVJJVFkgSU5WT0tFUgorICBMQU5HVUFHRSBw
bHBnc3FsIEFTICQkIEJFR0lOIFJFVFVSTiA0MjsgRU5EOyAkJDsKK0NSRUFURSBQUk9DRURVUkUg
dGVzdHBfdHJ1c3QzKCkgU0VDVVJJVFkgSU5WT0tFUgorICBMQU5HVUFHRSBwbHBnc3FsIEFTICQk
IEJFR0lOIFBFUkZPUk0gNDI7IEVORDsgJCQ7CitDUkVBVEUgRlVOQ1RJT04gdGVzdGZfdHJ1c3Q0
KCkgUkVUVVJOUyBJTlQgU0VDVVJJVFkgREVGSU5FUgorICBMQU5HVUFHRSBwbHBnc3FsIEFTICQk
IEJFR0lOIFJFVFVSTiA0MjsgRU5EOyAkJDsKK0NSRUFURSBWSUVXIHRlc3R2X3RydXN0MSBXSVRI
IChzZWN1cml0eV9pbnZva2VyID0gdHJ1ZSkKKyAgQVMgU0VMRUNUIHRlc3RmX3RydXN0NCgpLCB0
ZXN0Zl90cnVzdDEoKTsKK0NSRUFURSBWSUVXIHRlc3R2X3RydXN0MiBXSVRIIChzZWN1cml0eV9p
bnZva2VyID0gZmFsc2UpCisgIEFTIFNFTEVDVCB0ZXN0Zl90cnVzdDIoKSwgdGVzdGZfdHJ1c3Q0
KCk7CitHUkFOVCBTRUxFQ1QgT04gdGVzdHZfdHJ1c3QxIFRPIHJlZ3Jlc3NfcHJpdl91c2VyMSwg
cmVncmVzc19wcml2X3VzZXI3OworR1JBTlQgU0VMRUNUIE9OIHRlc3R2X3RydXN0MiBUTyByZWdy
ZXNzX3ByaXZfdXNlcjEsIHJlZ3Jlc3NfcHJpdl91c2VyNzsKKy0tIHNob3VsZCBzdWNjZWVkOyBy
ZWdyZXNzX3ByaXZfdXNlcjIgaXMgYSBtZW1iZXIgb2YgcmVncmVzc19wcml2X3VzZXIxCitTRVQg
U0VTU0lPTiBBVVRIT1JJWkFUSU9OIHJlZ3Jlc3NfcHJpdl91c2VyMTsKK1NFVCBjaGVja19mdW5j
dGlvbl9vd25lcl90cnVzdCA9IHRydWU7CitTRUxFQ1QgdGVzdGZfdHJ1c3QxKCk7CisgdGVzdGZf
dHJ1c3QxIAorLS0tLS0tLS0tLS0tLS0KKyAgICAgICAgICAgNDIKKygxIHJvdykKKworU0VMRUNU
IHRlc3RmX3RydXN0MigpOworIHRlc3RmX3RydXN0MiAKKy0tLS0tLS0tLS0tLS0tCisgICAgICAg
ICAgIDQyCisoMSByb3cpCisKK0NBTEwgdGVzdHBfdHJ1c3QzKCk7CitTRUxFQ1QgdGVzdGZfdHJ1
c3Q0KCk7CisgdGVzdGZfdHJ1c3Q0IAorLS0tLS0tLS0tLS0tLS0KKyAgICAgICAgICAgNDIKKygx
IHJvdykKKworU0VMRUNUICogRlJPTSB0ZXN0dl90cnVzdDE7CisgdGVzdGZfdHJ1c3Q0IHwgdGVz
dGZfdHJ1c3QxIAorLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0KKyAgICAgICAgICAgNDIg
fCAgICAgICAgICAgNDIKKygxIHJvdykKKworU0VMRUNUICogRlJPTSB0ZXN0dl90cnVzdDI7Cisg
dGVzdGZfdHJ1c3QyIHwgdGVzdGZfdHJ1c3Q0IAorLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0t
LS0KKyAgICAgICAgICAgNDIgfCAgICAgICAgICAgNDIKKygxIHJvdykKKworU0VUIFNFU1NJT04g
QVVUSE9SSVpBVElPTiByZWdyZXNzX3ByaXZfdXNlcjc7CitTRVQgY2hlY2tfZnVuY3Rpb25fb3du
ZXJfdHJ1c3QgPSB0cnVlOworU0VMRUNUIHRlc3RmX3RydXN0MSgpOyAtLSBmYWlscworRVJST1I6
ICBjYW5ub3QgZXhlY3V0ZSBmdW5jdGlvbiB0ZXN0Zl90cnVzdDEgb3duZWQgYnkgdW50cnVzdGVk
IHVzZXIgcmVncmVzc19wcml2X3VzZXIyCitERVRBSUw6ICBXaGVuIGNoZWNrX2Z1bmN0aW9uX293
bmVyX3RydXN0IGlzIG9uLCBTRUNVUklUWSBJTlZPS0VSIGZ1bmN0aW9ucyBtdXN0IGJlIG93bmVk
IGJ5IGEgcm9sZSB0aGF0IGNhbiBTRVQgUk9MRSB0byB0aGUgY2FsbGluZyB1c2VyLgorU0VMRUNU
IHRlc3RmX3RydXN0MigpOyAtLSBmYWlscworRVJST1I6ICBjYW5ub3QgZXhlY3V0ZSBmdW5jdGlv
biB0ZXN0Zl90cnVzdDIgb3duZWQgYnkgdW50cnVzdGVkIHVzZXIgcmVncmVzc19wcml2X3VzZXIy
CitERVRBSUw6ICBXaGVuIGNoZWNrX2Z1bmN0aW9uX293bmVyX3RydXN0IGlzIG9uLCBTRUNVUklU
WSBJTlZPS0VSIGZ1bmN0aW9ucyBtdXN0IGJlIG93bmVkIGJ5IGEgcm9sZSB0aGF0IGNhbiBTRVQg
Uk9MRSB0byB0aGUgY2FsbGluZyB1c2VyLgorQ0FMTCB0ZXN0cF90cnVzdDMoKTsgLS0gZmFpbHMK
K0VSUk9SOiAgY2Fubm90IGV4ZWN1dGUgZnVuY3Rpb24gdGVzdHBfdHJ1c3QzIG93bmVkIGJ5IHVu
dHJ1c3RlZCB1c2VyIHJlZ3Jlc3NfcHJpdl91c2VyMgorREVUQUlMOiAgV2hlbiBjaGVja19mdW5j
dGlvbl9vd25lcl90cnVzdCBpcyBvbiwgU0VDVVJJVFkgSU5WT0tFUiBmdW5jdGlvbnMgbXVzdCBi
ZSBvd25lZCBieSBhIHJvbGUgdGhhdCBjYW4gU0VUIFJPTEUgdG8gdGhlIGNhbGxpbmcgdXNlci4K
K1NFTEVDVCB0ZXN0Zl90cnVzdDQoKTsKKyB0ZXN0Zl90cnVzdDQgCistLS0tLS0tLS0tLS0tLQor
ICAgICAgICAgICA0MgorKDEgcm93KQorCitTRUxFQ1QgKiBGUk9NIHRlc3R2X3RydXN0MTsgLS0g
ZmFpbHMKK0VSUk9SOiAgY2Fubm90IGV4ZWN1dGUgZnVuY3Rpb24gdGVzdGZfdHJ1c3QxIG93bmVk
IGJ5IHVudHJ1c3RlZCB1c2VyIHJlZ3Jlc3NfcHJpdl91c2VyMgorREVUQUlMOiAgV2hlbiBjaGVj
a19mdW5jdGlvbl9vd25lcl90cnVzdCBpcyBvbiwgU0VDVVJJVFkgSU5WT0tFUiBmdW5jdGlvbnMg
bXVzdCBiZSBvd25lZCBieSBhIHJvbGUgdGhhdCBjYW4gU0VUIFJPTEUgdG8gdGhlIGNhbGxpbmcg
dXNlci4KK1NFTEVDVCAqIEZST00gdGVzdHZfdHJ1c3QyOyAtLSBmYWlscworRVJST1I6ICBjYW5u
b3QgZXhlY3V0ZSBmdW5jdGlvbiB0ZXN0Zl90cnVzdDIgb3duZWQgYnkgdW50cnVzdGVkIHVzZXIg
cmVncmVzc19wcml2X3VzZXIyCitERVRBSUw6ICBXaGVuIGNoZWNrX2Z1bmN0aW9uX293bmVyX3Ry
dXN0IGlzIG9uLCBTRUNVUklUWSBJTlZPS0VSIGZ1bmN0aW9ucyBtdXN0IGJlIG93bmVkIGJ5IGEg
cm9sZSB0aGF0IGNhbiBTRVQgUk9MRSB0byB0aGUgY2FsbGluZyB1c2VyLgorU0VUIFNFU1NJT04g
QVVUSE9SSVpBVElPTiByZWdyZXNzX3ByaXZfdXNlcjI7CitEUk9QIFZJRVcgdGVzdHZfdHJ1c3Qx
OworRFJPUCBWSUVXIHRlc3R2X3RydXN0MjsKK0RST1AgRlVOQ1RJT04gdGVzdGZfdHJ1c3QxKCk7
CitEUk9QIEZVTkNUSU9OIHRlc3RmX3RydXN0MigpOworRFJPUCBQUk9DRURVUkUgdGVzdHBfdHJ1
c3QzKCk7CitEUk9QIEZVTkNUSU9OIHRlc3RmX3RydXN0NCgpOworUkVTRVQgU0VTU0lPTiBBVVRI
T1JJWkFUSU9OOworUkVWT0tFIHJlZ3Jlc3NfcHJpdl91c2VyMSBGUk9NIHJlZ3Jlc3NfcHJpdl91
c2VyMjsKK1NFVCBjaGVja19mdW5jdGlvbl9vd25lcl90cnVzdCBUTyBERUZBVUxUOwogLS0gdGVz
dCBsZWFreS1mdW5jdGlvbiBwcm90ZWN0aW9ucyBpbiBzZWxmdW5jcwogLS0gcmVncmVzc19wcml2
X3VzZXIxIHdpbGwgb3duIGEgdGFibGUgYW5kIHByb3ZpZGUgdmlld3MgZm9yIGl0LgogU0VUIFNF
U1NJT04gQVVUSE9SSVpBVElPTiByZWdyZXNzX3ByaXZfdXNlcjE7CmRpZmYgLS1naXQgYS9zcmMv
dGVzdC9yZWdyZXNzL3NxbC9wcml2aWxlZ2VzLnNxbCBiL3NyYy90ZXN0L3JlZ3Jlc3Mvc3FsL3By
aXZpbGVnZXMuc3FsCmluZGV4IDM5YWEwYjRlY2YuLjU3ZmQ5M2E1NzMgMTAwNjQ0Ci0tLSBhL3Ny
Yy90ZXN0L3JlZ3Jlc3Mvc3FsL3ByaXZpbGVnZXMuc3FsCisrKyBiL3NyYy90ZXN0L3JlZ3Jlc3Mv
c3FsL3ByaXZpbGVnZXMuc3FsCkBAIC0yNjUsNiArMjY1LDYzIEBAIGJhcgl0cnVlCiBcLgogU0VM
RUNUICogRlJPTSBhdGVzdDE7IC0tIG9rCiAKKy0tIHRlc3QgdGhhdCB3ZSB0cnVzdCB0aGUgb3du
ZXIgb2YgU0VDVVJJVFkgSU5WT0tFUiBmdW5jdGlvbnMKKworUkVTRVQgU0VTU0lPTiBBVVRIT1JJ
WkFUSU9OOworR1JBTlQgcmVncmVzc19wcml2X3VzZXIxIFRPIHJlZ3Jlc3NfcHJpdl91c2VyMjsK
KworU0VUIFNFU1NJT04gQVVUSE9SSVpBVElPTiByZWdyZXNzX3ByaXZfdXNlcjI7CisKK0NSRUFU
RSBGVU5DVElPTiB0ZXN0Zl90cnVzdDEoKSBSRVRVUk5TIElOVCBTRUNVUklUWSBJTlZPS0VSCisg
IExBTkdVQUdFIHNxbCBBUyAkJCBTRUxFQ1QgNDIgJCQ7CitDUkVBVEUgRlVOQ1RJT04gdGVzdGZf
dHJ1c3QyKCkgUkVUVVJOUyBJTlQgU0VDVVJJVFkgSU5WT0tFUgorICBMQU5HVUFHRSBwbHBnc3Fs
IEFTICQkIEJFR0lOIFJFVFVSTiA0MjsgRU5EOyAkJDsKK0NSRUFURSBQUk9DRURVUkUgdGVzdHBf
dHJ1c3QzKCkgU0VDVVJJVFkgSU5WT0tFUgorICBMQU5HVUFHRSBwbHBnc3FsIEFTICQkIEJFR0lO
IFBFUkZPUk0gNDI7IEVORDsgJCQ7CitDUkVBVEUgRlVOQ1RJT04gdGVzdGZfdHJ1c3Q0KCkgUkVU
VVJOUyBJTlQgU0VDVVJJVFkgREVGSU5FUgorICBMQU5HVUFHRSBwbHBnc3FsIEFTICQkIEJFR0lO
IFJFVFVSTiA0MjsgRU5EOyAkJDsKKworQ1JFQVRFIFZJRVcgdGVzdHZfdHJ1c3QxIFdJVEggKHNl
Y3VyaXR5X2ludm9rZXIgPSB0cnVlKQorICBBUyBTRUxFQ1QgdGVzdGZfdHJ1c3Q0KCksIHRlc3Rm
X3RydXN0MSgpOworQ1JFQVRFIFZJRVcgdGVzdHZfdHJ1c3QyIFdJVEggKHNlY3VyaXR5X2ludm9r
ZXIgPSBmYWxzZSkKKyAgQVMgU0VMRUNUIHRlc3RmX3RydXN0MigpLCB0ZXN0Zl90cnVzdDQoKTsK
KworR1JBTlQgU0VMRUNUIE9OIHRlc3R2X3RydXN0MSBUTyByZWdyZXNzX3ByaXZfdXNlcjEsIHJl
Z3Jlc3NfcHJpdl91c2VyNzsKK0dSQU5UIFNFTEVDVCBPTiB0ZXN0dl90cnVzdDIgVE8gcmVncmVz
c19wcml2X3VzZXIxLCByZWdyZXNzX3ByaXZfdXNlcjc7CisKKy0tIHNob3VsZCBzdWNjZWVkOyBy
ZWdyZXNzX3ByaXZfdXNlcjIgaXMgYSBtZW1iZXIgb2YgcmVncmVzc19wcml2X3VzZXIxCitTRVQg
U0VTU0lPTiBBVVRIT1JJWkFUSU9OIHJlZ3Jlc3NfcHJpdl91c2VyMTsKK1NFVCBjaGVja19mdW5j
dGlvbl9vd25lcl90cnVzdCA9IHRydWU7CisKK1NFTEVDVCB0ZXN0Zl90cnVzdDEoKTsKK1NFTEVD
VCB0ZXN0Zl90cnVzdDIoKTsKK0NBTEwgdGVzdHBfdHJ1c3QzKCk7CitTRUxFQ1QgdGVzdGZfdHJ1
c3Q0KCk7CitTRUxFQ1QgKiBGUk9NIHRlc3R2X3RydXN0MTsKK1NFTEVDVCAqIEZST00gdGVzdHZf
dHJ1c3QyOworCitTRVQgU0VTU0lPTiBBVVRIT1JJWkFUSU9OIHJlZ3Jlc3NfcHJpdl91c2VyNzsK
K1NFVCBjaGVja19mdW5jdGlvbl9vd25lcl90cnVzdCA9IHRydWU7CisKK1NFTEVDVCB0ZXN0Zl90
cnVzdDEoKTsgLS0gZmFpbHMKK1NFTEVDVCB0ZXN0Zl90cnVzdDIoKTsgLS0gZmFpbHMKK0NBTEwg
dGVzdHBfdHJ1c3QzKCk7IC0tIGZhaWxzCitTRUxFQ1QgdGVzdGZfdHJ1c3Q0KCk7CitTRUxFQ1Qg
KiBGUk9NIHRlc3R2X3RydXN0MTsgLS0gZmFpbHMKK1NFTEVDVCAqIEZST00gdGVzdHZfdHJ1c3Qy
OyAtLSBmYWlscworCitTRVQgU0VTU0lPTiBBVVRIT1JJWkFUSU9OIHJlZ3Jlc3NfcHJpdl91c2Vy
MjsKK0RST1AgVklFVyB0ZXN0dl90cnVzdDE7CitEUk9QIFZJRVcgdGVzdHZfdHJ1c3QyOworRFJP
UCBGVU5DVElPTiB0ZXN0Zl90cnVzdDEoKTsKK0RST1AgRlVOQ1RJT04gdGVzdGZfdHJ1c3QyKCk7
CitEUk9QIFBST0NFRFVSRSB0ZXN0cF90cnVzdDMoKTsKK0RST1AgRlVOQ1RJT04gdGVzdGZfdHJ1
c3Q0KCk7CisKK1JFU0VUIFNFU1NJT04gQVVUSE9SSVpBVElPTjsKK1JFVk9LRSByZWdyZXNzX3By
aXZfdXNlcjEgRlJPTSByZWdyZXNzX3ByaXZfdXNlcjI7CisKK1NFVCBjaGVja19mdW5jdGlvbl9v
d25lcl90cnVzdCBUTyBERUZBVUxUOwogCiAtLSB0ZXN0IGxlYWt5LWZ1bmN0aW9uIHByb3RlY3Rp
b25zIGluIHNlbGZ1bmNzCiAKLS0gCjIuMzQuMQoK


--=-WzA4PEPRBY+onHaIB3dO--