From: Yogesh Sharma <yogesh.sharma@catprosystems.com>
Content-Type: multipart/mixed; boundary="------------IS8gGTqL0NQM0muG9PtWu7aS"
Message-ID: <797ef53d-ecd2-4f23-8c33-1959b862a323@CatProSystems.com>
Date: Mon, 24 Feb 2025 14:51:33 -0500
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Securing PostgreSQL for rootless containers
To: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Content-Language: en-US
Autocrypt: addr=Yogesh.Sharma@CatProSystems.com; keydata=
 xjMEXkTQlhYJKwYBBAHaRw8BAQdAxDPDwsoO5hyT+yv8C53Vs39IdBzA2s0ZahS3JoetcoLN
 UVlvZ2VzaCBTaGFyYW1hIDxZb2dlc2guU2hhcm1hQENhdFByb1N5c3RlbXMuY29tPiAoaHR0
 cHM6Ly9ibG9nLmNhdHByb3N5c3RlbXMuY29tKcKdBBMWCgBFAhsDBQkS5emqBQsJCAcCAyIC
 AQYVCgkICwIEFgIDAQIeBwIXgBYhBFMYpI3RuRKrY/ZXRUd3i/HSqBJUBQJiOkZgAhkBAAoJ
 EEd3i/HSqBJUfisBAPRrveHNZarIp3zxYmSqQYfNpixi4ZQEkyBOjV/J+ym/AQDMz2AzHv/Y
 7HFVolI6A7qChZWBifWnNqkYb5o/IKgLAc44BF5E0JYSCisGAQQBl1UBBQEBB0C1aX+29TBm
 TCD00vLDaSuBq/3eotVWJuLo6J5m2x/oNwMBCAfCfgQYFggAJhYhBFMYpI3RuRKrY/ZXRUd3
 i/HSqBJUBQJeRNCWAhsMBQkSzAMAAAoJEEd3i/HSqBJUWw8A/iO9ibRxr6inyGJwk2ektVb0
 KiHfszWWMHEUDqbhQ56YAQD9ZHs+QJ3YmfyBfTNzdmkSQuuduQviBhTyNwo/2IitCw==
Archived-At: <https://www.postgresql.org/message-id/797ef53d-ecd2-4f23-8c33-1959b862a323%40CatProSystems.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------IS8gGTqL0NQM0muG9PtWu7aS
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable

Hello Hackers,

When running PostgreSQL in container as rootless and bridged network,=20
all connection will appear as local connection not matter what their=20
origin is and pg_hba.conf based allow/deny will not be effective.

One approach is to make PostgreSQL aware of systemd socket activation,=20
where systemd creates socket FDs and passes them to PostgreSQL. Thus=20
providing real connection originator. Many services have adopted systemd=20
socket activation and attached patch enables same for PostgreSQL.

This patch has effect on current use of socket unless systemd socket are=20
used. Code is also guarded when postgres is not compiled with systemd fla=
g.

Attached patch is based on HEAD.

Here is a sample systemd .socket (=20
~/.config/systemd/user/PostgreSQL-18.socket )
8<------
[Unit]
Description=3DPostgreSQL Server Socket
Conflicts=3Dpostgresql-18.service

[Socket]
ListenStream=3D127.0.0.1:5432
ListenStream=3D192.168.1.100:5432
ListenStream=3D/tmp/.s.PGSQL.5432
ListenStream=3D/run/user/1000/.s.PGSQL.5432

[Install]
WantedBy=3Dsockets.target
8<------

Match this name with quadlet .container name, for more details
https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html

For local testing one=C2=A0 can also use systemd-socket-activate, for mor=
e=20
details
https://www.freedesktop.org/software/systemd/man/latest/systemd-socket-ac=
tivate.html

Notes:
1. PostgreSQL config variables must match above sockets and order.
listen_addresses =3D '127.0.0.1,192.168.100.49'
unix_socket_directories =3D '/tmp/,/run/user/1000/'

Two TCP sockets and 2 unix sockets and in same order.

2. Since postgres container will be started on first connection,=20
"database system is starting up" message will be visible only for first=20
connection but not for subsequent connections.

make check-world passes with or without sytsemd and with socket activatio=
n.


--=20
Kind Regards,
Yogesh Sharma
PostgreSQL, Linux, and Networking Expert
Open Source Enthusiast and Advocate
PostgreSQL Contributors Team @ RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com

--------------IS8gGTqL0NQM0muG9PtWu7aS
Content-Type: text/x-patch; charset=UTF-8;
 name="0001-Add-systemd-socket-activation-supoort-in-postgresql.patch"
Content-Disposition: attachment;
 filename*0="0001-Add-systemd-socket-activation-supoort-in-postgresql.pat";
 filename*1="ch"
Content-Transfer-Encoding: base64

RnJvbSA1NjVjODNlNzAxNDA2ZWQ1MDRlYjg3MzhmYmM3OGM0MWYzNjE4MzcxIE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBZb2dlc2ggU2hhcm1hIDx5b2dlc2guc2hhcm1hQGNh
dHByb3N5c3RlbXMuY29tPgpEYXRlOiBXZWQsIDUgRmViIDIwMjUgMTc6MDY6MjEgLTA1MDAK
U3ViamVjdDogW1BBVENIXSBBZGQgc3lzdGVtZCBzb2NrZXQgYWN0aXZhdGlvbiBzdXBvb3J0
IGluIHBvc3RncmVzcWwuCgpTb2NrZXQgYWN0aXZpYXRpb24gZW5hYmxlcyBzeXN0ZW1kIHRv
IHN0YXJ0IHRoZSBjb25maWd1cmVkIGNvbmZpZ3VyZWQKc29ja2V0cyBhbmQgcGFzcyBGRHMg
dG8gUG9zdGdyZVNRTC4gVGhlc2UgY2hhbmdlcyBhcmUgb25seSBlZmZlY3RpdmUKd2hlbiBw
b3N0Z3JlcyBpcyBjb21waWxlZCB3aXRoIC0td2l0aC1zeXN0ZW1kIGFuZCBzeXN0ZW1kIC5z
b2NrZXQgaXMKdXNlZC4KCldoeSBhZGQgc29ja2V0IGFjdGl2YXRpb24gc3VwcG9ydD8KClNv
Y2tldCBhY3RpdmlhdGlvbiBoZWxwcyBpbiB0aGUgY2FzZSB3aGVyZSBwb3N0Z2VycyBjb250
YWluZXIgaXMgcnVubmluZwphcyByb290bGVzc2kgdW5kZXIgcG9kbWFuLiAgV2l0aG91dCB0
aGlzIGNoYW5nZSwgcG9zdGdyZXMgd2lsbCBzZWUgYWxsCmNvbm5lY3Rpb25zIGFzIG9yaWdp
bmF0aW5nIGZyb20gbG9jYWwgYW5kIHBnX2hiYSB3aWxsIG5vdCBiZSBhYmxlIHRvCmJsb2Nr
IGNvbm5lY3Rpb25zIGZyb20gaW50cmFuZXQgb3IgaW50ZXJuZXQuCgpwb3N0Z3Jlc3FsLTE4
LnNvY2tldAo4PC0tLS0tLQpbVW5pdF0KRGVzY3JpcHRpb249WVMgU2VydmVyIFNvY2tldApD
b25mbGljdHM9cG9zdGdyZXNxbC0xOC5zZXJ2aWNlCgpbU29ja2V0XQpMaXN0ZW5TdHJlYW09
MTI3LjAuMC4xOjU0MzIKTGlzdGVuU3RyZWFtPTE5Mi4xNjguMTAwLjQ5OjU0MzIKTGlzdGVu
U3RyZWFtPS90bXAvLnMuUEdTUUwuNTQzMgpMaXN0ZW5TdHJlYW09L3J1bi91c2VyLzEwMDAv
LnMuUEdTUUwuNTQzMgoKW0luc3RhbGxdCldhbnRlZEJ5PXNvY2tldHMudGFyZ2V0Cjg8LS0t
LS0tCgpNYXRjaCB0aGlzIG5hbWUgd2l0aCBxdWFkbGV0IC5jb250YWluZXIgbmFtZQpodHRw
czovL2RvY3MucG9kbWFuLmlvL2VuL2xhdGVzdC9tYXJrZG93bi9wb2RtYW4tc3lzdGVtZC51
bml0LjUuaHRtbAoKVGhpcyAuc29ja2V0IGZpbGUgZ2V0IGluc3RhbGxlZCBpbiAgfi8uY29u
ZmlnL3N5c3RlbS91c2VyIGFuZCBlbmFibGVkLgoKRm9yIGxvY2FsIHRlc3Rpbmcgb25lICBj
YW4gYWxzbyB1c2Ugc3lzdGVtZC1zb2NrZXQtYWN0aXZhdGUKaHR0cHM6Ly93d3cuZnJlZWRl
c2t0b3Aub3JnL3NvZnR3YXJlL3N5c3RlbWQvbWFuL2xhdGVzdC9zeXN0ZW1kLXNvY2tldC1h
Y3RpdmF0ZS5odG1sCgpQb3N0Z3Jlc3FsIENvbmZpZyB2YXJpYWJsZXMgc2hhbGwgbWF0Y2gg
YWJvdmUgc29ja2V0cy4KbGlzdGVuX2FkZHJlc3NlcyA9ICcxMjcuMC4wLjEsMTkyLjE2OC4x
MDAuNDknCnVuaXhfc29ja2V0X2RpcmVjdG9yaWVzID0gJy90bXAvLC9ydW4vdXNlci8xMDAw
LycKLS0tCiBzcmMvYmFja2VuZC9saWJwcS9wcWNvbW0uYyAgICAgICAgICAgICAgICAgICAg
fCA3NiArKysrKysrKysrKy0tLS0tLQogc3JjL3Rlc3QvcG9zdG1hc3Rlci9NYWtlZmlsZSAg
ICAgICAgICAgICAgICAgIHwgIDIgKwogLi4uL3QvMDA0X3N5c3RlbWRfc29ja2V0X2FjdGl2
YXRpb24ucGwgICAgICAgIHwgODQgKysrKysrKysrKysrKysrKysrKwogMyBmaWxlcyBjaGFu
Z2VkLCAxMzYgaW5zZXJ0aW9ucygrKSwgMjYgZGVsZXRpb25zKC0pCiBjcmVhdGUgbW9kZSAx
MDA2NDQgc3JjL3Rlc3QvcG9zdG1hc3Rlci90LzAwNF9zeXN0ZW1kX3NvY2tldF9hY3RpdmF0
aW9uLnBsCgpkaWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQvbGlicHEvcHFjb21tLmMgYi9zcmMv
YmFja2VuZC9saWJwcS9wcWNvbW0uYwppbmRleCBiZGRkNjQ2NWRlMi4uNDhmMWIwYjJmNjYg
MTAwNjQ0Ci0tLSBhL3NyYy9iYWNrZW5kL2xpYnBxL3BxY29tbS5jCisrKyBiL3NyYy9iYWNr
ZW5kL2xpYnBxL3BxY29tbS5jCkBAIC03Miw2ICs3MiwxMCBAQAogI2luY2x1ZGUgPG1zdGNw
aXAuaD4KICNlbmRpZgogCisjaWZkZWYgVVNFX1NZU1RFTUQKKyNpbmNsdWRlIDxzeXN0ZW1k
L3NkLWRhZW1vbi5oPgorI2VuZGlmCisKICNpbmNsdWRlICJjb21tb24vaXAuaCIKICNpbmNs
dWRlICJsaWJwcS9saWJwcS5oIgogI2luY2x1ZGUgIm1pc2NhZG1pbi5oIgpAQCAtNDIzLDYg
KzQyNyw3IEBAIExpc3RlblNlcnZlclBvcnQoaW50IGZhbWlseSwgY29uc3QgY2hhciAqaG9z
dE5hbWUsIHVuc2lnbmVkIHNob3J0IHBvcnROdW1iZXIsCiAJaW50CQkJZXJyOwogCWludAkJ
CW1heGNvbm47CiAJaW50CQkJcmV0OworCWludAkJCXN5c3RlbWRfZmRfY291bnQgPSAwOwog
CWNoYXIJCXBvcnROdW1iZXJTdHJbMzJdOwogCWNvbnN0IGNoYXIgKmZhbWlseURlc2M7CiAJ
Y2hhcgkJZmFtaWx5RGVzY0J1Zls2NF07CkBAIC00NDQsNiArNDQ5LDEyIEBAIExpc3RlblNl
cnZlclBvcnQoaW50IGZhbWlseSwgY29uc3QgY2hhciAqaG9zdE5hbWUsIHVuc2lnbmVkIHNo
b3J0IHBvcnROdW1iZXIsCiAJaGludC5haV9mbGFncyA9IEFJX1BBU1NJVkU7CiAJaGludC5h
aV9zb2NrdHlwZSA9IFNPQ0tfU1RSRUFNOwogCisjaWZkZWYgVVNFX1NZU1RFTUQKKwlzeXN0
ZW1kX2ZkX2NvdW50ID0gc2RfbGlzdGVuX2ZkcygwKTsKKwlpZiAoc3lzdGVtZF9mZF9jb3Vu
dCA+IDAgJiYgc3lzdGVtZF9mZF9jb3VudCA8PSAoKk51bUxpc3RlblNvY2tldHMpKQorCQll
bG9nKEZBVEFMLCAiU29ja2V0cyBwYXNzZWQgYnkgc3lzdGVtZCAgKCVkKSBhcmUgbGVzcyB0
aGFuIGxpc3Rlbl9hZGRyZXNzZXMgY29uZmlndXJlZCBpbiBwb3N0Z3Jlc3FsLmNvbmYiLCBz
eXN0ZW1kX2ZkX2NvdW50KTsKKyNlbmRpZgorCiAJaWYgKGZhbWlseSA9PSBBRl9VTklYKQog
CXsKIAkJLyoKQEAgLTQ1OSwxMiArNDcwLDE2IEBAIExpc3RlblNlcnZlclBvcnQoaW50IGZh
bWlseSwgY29uc3QgY2hhciAqaG9zdE5hbWUsIHVuc2lnbmVkIHNob3J0IHBvcnROdW1iZXIs
CiAJCQkJCQkJKGludCkgKFVOSVhTT0NLX1BBVEhfQlVGTEVOIC0gMSkpKSk7CiAJCQlyZXR1
cm4gU1RBVFVTX0VSUk9SOwogCQl9Ci0JCWlmIChMb2NrX0FGX1VOSVgodW5peFNvY2tldERp
ciwgdW5peFNvY2tldFBhdGgpICE9IFNUQVRVU19PSykKKwkJaWYgKHN5c3RlbWRfZmRfY291
bnQgPT0gMCAmJiBMb2NrX0FGX1VOSVgodW5peFNvY2tldERpciwgdW5peFNvY2tldFBhdGgp
ICE9IFNUQVRVU19PSykKIAkJCXJldHVybiBTVEFUVVNfRVJST1I7CiAJCXNlcnZpY2UgPSB1
bml4U29ja2V0UGF0aDsKKwkJaWYgKHN5c3RlbWRfZmRfY291bnQgPiAwICYmIHNkX2lzX3Nv
Y2tldF91bml4KFNEX0xJU1RFTl9GRFNfU1RBUlQgKyAoKk51bUxpc3RlblNvY2tldHMpLCBT
T0NLX1NUUkVBTSwgMSwgdW5peFNvY2tldFBhdGgsIDApIDwgMSkKKwkJCWVsb2coRkFUQUws
ICJTb2NrZXRzICglZCkgcGFzc2VkIGJ5IHN5c3RlbWQgaXMgbm90IHNhbWUgdHlwZSBhcyBj
b25maWd1cmVkIGluIHBvc3RncmVzcWwuY29uZiIsICpOdW1MaXN0ZW5Tb2NrZXRzKTsKIAl9
CiAJZWxzZQogCXsKKwkJaWYgKHN5c3RlbWRfZmRfY291bnQgPiAwICYmIHNkX2lzX3NvY2tl
dF9pbmV0KFNEX0xJU1RFTl9GRFNfU1RBUlQgKyAoKk51bUxpc3RlblNvY2tldHMpLCBBRl9V
TlNQRUMsIFNPQ0tfU1RSRUFNLCAxLCBwb3J0TnVtYmVyKSA8IDEpCisJCQllbG9nKEZBVEFM
LCAiU29ja2V0cyAoJWQpIHBhc3NlZCBieSBzeXN0ZW1kIGlzIG5vdCBzYW1lIHR5cGUgYXMg
Y29uZmlndXJlZCBpbiBwb3N0Z3Jlc3FsLmNvbmYiLCAqTnVtTGlzdGVuU29ja2V0cyk7CiAJ
CXNucHJpbnRmKHBvcnROdW1iZXJTdHIsIHNpemVvZihwb3J0TnVtYmVyU3RyKSwgIiVkIiwg
cG9ydE51bWJlcik7CiAJCXNlcnZpY2UgPSBwb3J0TnVtYmVyU3RyOwogCX0KQEAgLTUzOCw3
ICs1NTMsMTQgQEAgTGlzdGVuU2VydmVyUG9ydChpbnQgZmFtaWx5LCBjb25zdCBjaGFyICpo
b3N0TmFtZSwgdW5zaWduZWQgc2hvcnQgcG9ydE51bWJlciwKIAkJCWFkZHJEZXNjID0gYWRk
ckJ1ZjsKIAkJfQogCi0JCWlmICgoZmQgPSBzb2NrZXQoYWRkci0+YWlfZmFtaWx5LCBTT0NL
X1NUUkVBTSwgMCkpID09IFBHSU5WQUxJRF9TT0NLRVQpCisJCWlmIChzeXN0ZW1kX2ZkX2Nv
dW50ID4gMCkKKwkJeworCQkJZmQgPSBTRF9MSVNURU5fRkRTX1NUQVJUICsgKCpOdW1MaXN0
ZW5Tb2NrZXRzKTsKKwkJCWVyZXBvcnQoTE9HLCAoZXJybXNnKCJVc2luZyBzeXN0ZW1kIEZE
ICVkIGF0ICVkIiwgZmQsICpOdW1MaXN0ZW5Tb2NrZXRzKSkpOworCQl9CisJCWVsc2UKKwkJ
CWZkID0gc29ja2V0KGFkZHItPmFpX2ZhbWlseSwgU09DS19TVFJFQU0sIDApOworCQlpZiAo
ZmQgPT0gUEdJTlZBTElEX1NPQ0tFVCkKIAkJewogCQkJZXJlcG9ydChMT0csCiAJCQkJCShl
cnJjb2RlX2Zvcl9zb2NrZXRfYWNjZXNzKCksCkBAIC01OTgsMzIgKzYyMCwzNCBAQCBMaXN0
ZW5TZXJ2ZXJQb3J0KGludCBmYW1pbHksIGNvbnN0IGNoYXIgKmhvc3ROYW1lLCB1bnNpZ25l
ZCBzaG9ydCBwb3J0TnVtYmVyLAogCQkJfQogCQl9CiAjZW5kaWYKLQotCQkvKgotCQkgKiBO
b3RlOiBUaGlzIG1pZ2h0IGZhaWwgb24gc29tZSBPUydzLCBsaWtlIExpbnV4IG9sZGVyIHRo
YW4KLQkJICogMi40LjIxLXByZTMsIHRoYXQgZG9uJ3QgaGF2ZSB0aGUgSVBWNl9WNk9OTFkg
c29ja2V0IG9wdGlvbiwgYW5kIG1hcAotCQkgKiBpcHY0IGFkZHJlc3NlcyB0byBpcHY2LiAg
SXQgd2lsbCBzaG93IDo6ZmZmZjppcHY0IGZvciBhbGwgaXB2NAotCQkgKiBjb25uZWN0aW9u
cy4KLQkJICovCi0JCWVyciA9IGJpbmQoZmQsIGFkZHItPmFpX2FkZHIsIGFkZHItPmFpX2Fk
ZHJsZW4pOwotCQlpZiAoZXJyIDwgMCkKKwkJaWYgKHN5c3RlbWRfZmRfY291bnQgPT0gMCkK
IAkJewotCQkJaW50CQkJc2F2ZWRfZXJybm8gPSBlcnJubzsKKwkJCS8qCisJCQkgKiBOb3Rl
OiBUaGlzIG1pZ2h0IGZhaWwgb24gc29tZSBPUydzLCBsaWtlIExpbnV4IG9sZGVyIHRoYW4K
KwkJCSAqIDIuNC4yMS1wcmUzLCB0aGF0IGRvbid0IGhhdmUgdGhlIElQVjZfVjZPTkxZIHNv
Y2tldCBvcHRpb24sIGFuZAorCQkJICogbWFwIGlwdjQgYWRkcmVzc2VzIHRvIGlwdjYuICBJ
dCB3aWxsIHNob3cgOjpmZmZmOmlwdjQgZm9yIGFsbAorCQkJICogaXB2NCBjb25uZWN0aW9u
cy4KKwkJCSAqLworCQkJZXJyID0gYmluZChmZCwgYWRkci0+YWlfYWRkciwgYWRkci0+YWlf
YWRkcmxlbik7CisJCQlpZiAoZXJyIDwgMCkKKwkJCXsKKwkJCQlpbnQJCQlzYXZlZF9lcnJu
byA9IGVycm5vOwogCi0JCQllcmVwb3J0KExPRywKLQkJCQkJKGVycmNvZGVfZm9yX3NvY2tl
dF9hY2Nlc3MoKSwKLQkJCS8qIHRyYW5zbGF0b3I6IGZpcnN0ICVzIGlzIElQdjQsIElQdjYs
IG9yIFVuaXggKi8KLQkJCQkJIGVycm1zZygiY291bGQgbm90IGJpbmQgJXMgYWRkcmVzcyBc
IiVzXCI6ICVtIiwKLQkJCQkJCQlmYW1pbHlEZXNjLCBhZGRyRGVzYyksCi0JCQkJCSBzYXZl
ZF9lcnJubyA9PSBFQUREUklOVVNFID8KLQkJCQkJIChhZGRyLT5haV9mYW1pbHkgPT0gQUZf
VU5JWCA/Ci0JCQkJCSAgZXJyaGludCgiSXMgYW5vdGhlciBwb3N0bWFzdGVyIGFscmVhZHkg
cnVubmluZyBvbiBwb3J0ICVkPyIsCi0JCQkJCQkJICAoaW50KSBwb3J0TnVtYmVyKSA6Ci0J
CQkJCSAgZXJyaGludCgiSXMgYW5vdGhlciBwb3N0bWFzdGVyIGFscmVhZHkgcnVubmluZyBv
biBwb3J0ICVkPyIKLQkJCQkJCQkgICIgSWYgbm90LCB3YWl0IGEgZmV3IHNlY29uZHMgYW5k
IHJldHJ5LiIsCi0JCQkJCQkJICAoaW50KSBwb3J0TnVtYmVyKSkgOiAwKSk7Ci0JCQljbG9z
ZXNvY2tldChmZCk7Ci0JCQljb250aW51ZTsKKwkJCQllcmVwb3J0KExPRywKKwkJCQkJCShl
cnJjb2RlX2Zvcl9zb2NrZXRfYWNjZXNzKCksCisJCQkJLyogdHJhbnNsYXRvcjogZmlyc3Qg
JXMgaXMgSVB2NCwgSVB2Niwgb3IgVW5peCAqLworCQkJCQkJIGVycm1zZygiY291bGQgbm90
IGJpbmQgJXMgYWRkcmVzcyBcIiVzXCI6ICVtIiwKKwkJCQkJCQkJZmFtaWx5RGVzYywgYWRk
ckRlc2MpLAorCQkJCQkJIHNhdmVkX2Vycm5vID09IEVBRERSSU5VU0UgPworCQkJCQkJIChh
ZGRyLT5haV9mYW1pbHkgPT0gQUZfVU5JWCA/CisJCQkJCQkgIGVycmhpbnQoIklzIGFub3Ro
ZXIgcG9zdG1hc3RlciBhbHJlYWR5IHJ1bm5pbmcgb24gcG9ydCAlZD8iLAorCQkJCQkJCQkg
IChpbnQpIHBvcnROdW1iZXIpIDoKKwkJCQkJCSAgZXJyaGludCgiSXMgYW5vdGhlciBwb3N0
bWFzdGVyIGFscmVhZHkgcnVubmluZyBvbiBwb3J0ICVkPyIKKwkJCQkJCQkJICAiIElmIG5v
dCwgd2FpdCBhIGZldyBzZWNvbmRzIGFuZCByZXRyeS4iLAorCQkJCQkJCQkgIChpbnQpIHBv
cnROdW1iZXIpKSA6IDApKTsKKwkJCQljbG9zZXNvY2tldChmZCk7CisJCQkJY29udGludWU7
CisJCQl9CiAJCX0KIAogCQlpZiAoYWRkci0+YWlfZmFtaWx5ID09IEFGX1VOSVgpCmRpZmYg
LS1naXQgYS9zcmMvdGVzdC9wb3N0bWFzdGVyL01ha2VmaWxlIGIvc3JjL3Rlc3QvcG9zdG1h
c3Rlci9NYWtlZmlsZQppbmRleCBlMDZiODFmOGM0Ny4uZTFkNzllZTJhMDcgMTAwNjQ0Ci0t
LSBhL3NyYy90ZXN0L3Bvc3RtYXN0ZXIvTWFrZWZpbGUKKysrIGIvc3JjL3Rlc3QvcG9zdG1h
c3Rlci9NYWtlZmlsZQpAQCAtMTMsNiArMTMsOCBAQCBzdWJkaXIgPSBzcmMvdGVzdC9wb3N0
bWFzdGVyCiB0b3BfYnVpbGRkaXIgPSAuLi8uLi8uLgogaW5jbHVkZSAkKHRvcF9idWlsZGRp
cikvc3JjL01ha2VmaWxlLmdsb2JhbAogCitleHBvcnQgd2l0aF9zeXN0ZW1kCisKIGNoZWNr
OgogCSQocHJvdmVfY2hlY2spCiAKZGlmZiAtLWdpdCBhL3NyYy90ZXN0L3Bvc3RtYXN0ZXIv
dC8wMDRfc3lzdGVtZF9zb2NrZXRfYWN0aXZhdGlvbi5wbCBiL3NyYy90ZXN0L3Bvc3RtYXN0
ZXIvdC8wMDRfc3lzdGVtZF9zb2NrZXRfYWN0aXZhdGlvbi5wbApuZXcgZmlsZSBtb2RlIDEw
MDY0NAppbmRleCAwMDAwMDAwMDAwMC4uMzc0Y2NmMWFiYjEKLS0tIC9kZXYvbnVsbAorKysg
Yi9zcmMvdGVzdC9wb3N0bWFzdGVyL3QvMDA0X3N5c3RlbWRfc29ja2V0X2FjdGl2YXRpb24u
cGwKQEAgLTAsMCArMSw4NCBAQAorCisjIENvcHlyaWdodCAoYykgMjAyNC0yMDI1LCBQb3N0
Z3JlU1FMIEdsb2JhbCBEZXZlbG9wbWVudCBHcm91cAorCit1c2Ugc3RyaWN0OwordXNlIHdh
cm5pbmdzIEZBVEFMID0+ICdhbGwnOwordXNlIGxvY2FsZTsKKwordXNlIFBvc3RncmVTUUw6
OlRlc3Q6OkNsdXN0ZXI7Cit1c2UgUG9zdGdyZVNRTDo6VGVzdDo6VXRpbHM7Cit1c2UgVGlt
ZTo6SGlSZXMgcXcoc2xlZXApOwordXNlIFRlc3Q6Ok1vcmU7CisKK2lmICgkRU5We3dpdGhf
c3lzdGVtZH0gbmUgJ3llcycpCit7CisJcGxhbiBza2lwX2FsbCA9PiAnc3lzdGVtZCBub3Qg
c3VwcG9ydGVkIGJ5IHRoaXMgYnVpbGQnOworfQorCisjIE5vZGUgaW5pdGlhbGl6YXRpb24K
K215ICRub2RlID0gUG9zdGdyZVNRTDo6VGVzdDo6Q2x1c3Rlci0+bmV3KCdzb2NrZXQnKTsK
KworJG5vZGUtPmluaXQoKTsKKworbXkgJHBvcnQgPSAkbm9kZS0+cG9ydDsKK215ICRwZ2Rh
dGEgPSAkbm9kZS0+ZGF0YV9kaXI7CitteSAkbG9nZmlsZSA9ICRub2RlLT5sb2dmaWxlOwor
bXkgJHJldDsKK215ICRsb2dzdGFydDsKKworIyBTdGFydGluZyBwb3N0Z3JlcyB1c2luZyBz
eXN0ZW1kLXNvY2tldC1hY3RpdmF0ZQorIyAtbCAxMjcuMC4wLjE6NTQzMiAtbCAxOTIuMTY4
LjEwMC40OTo1NDMyCisjIC1sIFsyNjAwOjE3MDA6MzFmMDo2YjdmOjVhNDc6Y2FmZjpmZTcz
OjkyNGZdOjU0MzIKKyMgLWwgL3RtcC8ucy5QR1NRTC41NDMyCisjIC1sIC9ydW4vdXNlci8x
MDAwLy5zLlBHU1FMLjU0MzIgJFBHX0RFVl9JTlNUL2Jpbi9wb3N0Z3JlcworIyAtRCAkUEdE
QVRBCisjIFN0YXJ0IHBvc3RncmVzcWwgdXNpbmcgc3lzdGVtCitteSAkdGNwX2ZkID0gIiAt
bCAxMjcuMC4wLjE6Ii4kcG9ydDsKK215ICR1bml4X2ZkID0gIiAtbCAvdG1wLy5zLlBHU1FM
LiIuJHBvcnQ7CitteSAkcGdfY21kID0gIiBwb3N0Z3JlcyAtRCAiLiRwZ2RhdGEuIiAmPj4i
LiRsb2dmaWxlLiIgJiI7CitteSAkc3lzdGVtZF9jbWQgPSAic3lzdGVtZC1zb2NrZXQtYWN0
aXZhdGUgIi4kdGNwX2ZkLiR1bml4X2ZkLiRwZ19jbWQ7CitteSAkc3lzdGVtZF9iYWQxID0g
InN5c3RlbWQtc29ja2V0LWFjdGl2YXRlICIuJHVuaXhfZmQuJHRjcF9mZC4kcGdfY21kOwor
bXkgJHN5c3RlbWRfYmFkMiA9ICJzeXN0ZW1kLXNvY2tldC1hY3RpdmF0ZSAiLiR0Y3BfZmQu
JHBnX2NtZDsKKworIyBTZXR1cCBsaXN0ZW5fYWRkcmVzcworJG5vZGUtPmFwcGVuZF9jb25m
KCdwb3N0Z3Jlc3FsLmNvbmYnLCAibGlzdGVuX2FkZHJlc3NlcyA9ICcxMjcuMC4wLjEnIik7
CisjIFNldHVwIHVuaXhfc29ja2V0X2RpcmVjdG9yeQorJG5vZGUtPmFwcGVuZF9jb25mKCdw
b3N0Z3Jlc3FsLmNvbmYnLCAidW5peF9zb2NrZXRfZGlyZWN0b3JpZXMgPSAnL3RtcCciKTsK
KworIyBTdGFydCB3aXRoIGFuIGVtcHR5IGxvZ2ZpbGUKKyRyZXQgPSBQb3N0Z3JlU1FMOjpU
ZXN0OjpVdGlsczo6c3lzdGVtX2xvZyggImVjaG8gJyc+Ii4kbG9nZmlsZSApOworCitub3Rl
ICdCYWQgdGVzdCAxJzsKKyMgVGVzdCBwYXNzaW5nIEZEIGluIHdyb25nIG9yZGVyCiskcmV0
ID0gUG9zdGdyZVNRTDo6VGVzdDo6VXRpbHM6OnN5c3RlbV9sb2coICRzeXN0ZW1kX2JhZDEg
KTsKK29rKCRyZXQgPT0gIjAiLCAic3lzdGVtZC1zb2NrZXQtYWN0aXZhdGUgc3RhcnRlZCIp
OworJGxvZ3N0YXJ0ID0gLXMgJG5vZGUtPmxvZ2ZpbGU7CisjIHBzcWw6IGVycm9yOiBjb25u
ZWN0aW9uIHRvIHNlcnZlciBhdCAiMTI3LjAuMC4xIiwgcG9ydCA1NDMyIGZhaWxlZDogRkFU
QUw6ICB0aGUgZGF0YWJhc2Ugc3lzdGVtIGlzIHN0YXJ0aW5nIHVwCiskbm9kZS0+Y29ubmVj
dF9mYWlscygiaG9zdD0xMjcuMC4wLjEiLCAiQ2hlY2sgZm9yIGZhaWx1cmUgZHVlIHRvIHdy
b25nIEZEIG9yZGVyIiwKKyAgZXhwZWN0ZWRfc3RkZXJyID0+IHFyL2ZhaWxlZDogc2VydmVy
IGNsb3NlZCB0aGUgY29ubmVjdGlvbiB1bmV4cGVjdGVkbHkvKTsKK29rKCAkbm9kZS0+bG9n
X2NvbnRhaW5zKHFyL0ZBVEFMOiAgU29ja2V0cyBcKDBcKSBwYXNzZWQgYnkgc3lzdGVtZCBp
cyBub3Qgc2FtZSB0eXBlIGFzIGNvbmZpZ3VyZWQgaW4gcG9zdGdyZXNxbC5jb25mLywgJGxv
Z3N0YXJ0KSwKKwkiQ2hlY2sgZm9yIHNvY2tldCAwIG1pc210YWNoIG1lc3NhZ2UiKTsKKwor
Citub3RlICdCYWQgdGVzdCAyJzsKKyMgT25seSBwYXNzIFRDUCBGRAorJHJldCA9IFBvc3Rn
cmVTUUw6OlRlc3Q6OlV0aWxzOjpzeXN0ZW1fbG9nKCAkc3lzdGVtZF9iYWQyICk7Citvaygk
cmV0ID09ICIwIiwgInN5c3RlbWQtc29ja2V0LWFjdGl2YXRlIHN0YXJ0ZWQiKTsKKyRsb2dz
dGFydCA9IC1zICRub2RlLT5sb2dmaWxlOworIyBwc3FsOiBlcnJvcjogY29ubmVjdGlvbiB0
byBzZXJ2ZXIgYXQgIjEyNy4wLjAuMSIsIHBvcnQgNTQzMiBmYWlsZWQ6IEZBVEFMOiAgdGhl
IGRhdGFiYXNlIHN5c3RlbSBpcyBzdGFydGluZyB1cAorJG5vZGUtPmNvbm5lY3RfZmFpbHMo
Imhvc3Q9MTI3LjAuMC4xIiwgIkNoZWNrIGZvciBmYWlsdXJlIGR1ZSB0byB3cm9uZyBGRCBw
YXNzZWQiLAorICBleHBlY3RlZF9zdGRlcnIgPT4gcXIvZmFpbGVkOiBzZXJ2ZXIgY2xvc2Vk
IHRoZSBjb25uZWN0aW9uIHVuZXhwZWN0ZWRseS8pOworb2soICRub2RlLT5sb2dfY29udGFp
bnMocXIvRkFUQUw6ICBTb2NrZXRzIHBhc3NlZCBieSBzeXN0ZW1kICBcKDFcKSBhcmUgbGVz
cyB0aGFuIGxpc3Rlbl9hZGRyZXNzZXMgY29uZmlndXJlZCBpbiBwb3N0Z3Jlc3FsLmNvbmYv
LCAkbG9nc3RhcnQpLAorCSJDaGVjayBmb3Igc29ja2V0IDAgbWlzbXRhY2ggbWVzc2FnZSIp
OworCitub3RlICdHb29kIHRlc3QnOworIyBUaGlzIGlzIGEgZ29vZCB0ZXN0IHdpdGggYWxs
IHRoZSBjb3JyZWN0IHNldHRpbmdzCiskcmV0ID0gUG9zdGdyZVNRTDo6VGVzdDo6VXRpbHM6
OnN5c3RlbV9sb2coICRzeXN0ZW1kX2NtZCApOworb2soJHJldCA9PSAiMCIsICJzeXN0ZW1k
LXNvY2tldC1hY3RpdmF0ZSBzdGFydGVkIik7CisjIHBzcWw6IGVycm9yOiBjb25uZWN0aW9u
IHRvIHNlcnZlciBhdCAiMTI3LjAuMC4xIiwgcG9ydCA1NDMyIGZhaWxlZDogRkFUQUw6ICB0
aGUgZGF0YWJhc2Ugc3lzdGVtIGlzIHN0YXJ0aW5nIHVwCiskbm9kZS0+Y29ubmVjdF9mYWls
cygiaG9zdD0xMjcuMC4wLjEiLCAiZGF0YWJhc2Ugc3lzdGVtIGlzIHN0YXJ0aW5nIHVwIiwg
ZXhwZWN0ZWRfc3RkZXJyID0+IHFyL0ZBVEFMOiAgdGhlIGRhdGFiYXNlIHN5c3RlbSBpcyBz
dGFydGluZyB1cC8pOworc2xlZXAoMSk7Ciskbm9kZS0+Y29ubmVjdF9vaygiaG9zdD0xMjcu
MC4wLjEiLCAiQ29ubmVjdCB0byBJUCB3b3JrcyIpOworJG5vZGUtPmNvbm5lY3Rfb2soImhv
c3Q9L3RtcCIsICJDb25uZWN0IHRvIHVuaXhfc29jayB3b3JrcyIpOworJG5vZGUtPnN0b3Ao
KTsKK2RvbmVfdGVzdGluZygpOwotLSAKMi40OC4xCgo=

--------------IS8gGTqL0NQM0muG9PtWu7aS--