Content-Type: multipart/mixed;
	boundary="------------I7zu0QyiS2Dm0ZGgptbxEJL2"
Message-ID: <fff0d7c1-8ad4-76a1-9db3-0ab6ec338bf7@amazon.com>
Date: Fri, 19 Aug 2022 10:12:57 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0)
 Gecko/20100101 Thunderbird/102.1.2
Content-Language: en-US
From: "Drouvot, Bertrand" <bdrouvot@amazon.com>
Subject: Patch proposal: make use of regular expressions for the username in
 pg_hba.conf
To: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Archived-At: 
 <https://www.postgresql.org/message-id/fff0d7c1-8ad4-76a1-9db3-0ab6ec338bf7%40amazon.com>
Precedence: bulk

--------------I7zu0QyiS2Dm0ZGgptbxEJL2
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 8bit

Hi hackers,

Attached is a patch proposal to allow the use of regular expressions for 
the username in pg_hba.conf.

Using regular expressions for the username in the pg_hba.conf file is 
convenient in situations where an organization has a large number of 
users and needs an expressive way to map them.

For example, if an organization wants to allow gss connections only for 
users having their principal, e.g. @BDTFOREST.LOCAL, they could make use 
of an entry in pg_hba.conf such as:

host all /^.*@BDTFOREST.LOCAL$ 0.0.0.0/0 gss

Without this patch, I can think of three alternatives with existing 
functionality, which all of tradeoffs. This includes:

1) Create an entry per user: this is challenging for organizations 
managing large numbers of users (e.g. 1000s). This is also not dynamic, 
i.e. the HBA file would need to be updated when users are added or removed.

2) Use a mapping in pg_ident.conf, for example:

Here is an entry in pg_hba.conf that uses a map:

host all all 0.0.0.0/0 gss map=mygssmap

and by defining this mapping in pg_ident.conf:

mygssmap /^(.*)@BDTFOREST\.LOCAL$ \1@BDTFOREST.LOCAL

That works for filtering the username.

LOG:  connection authenticated: identity="bertrand@BDTFOREST.LOCAL" 
method=gss (/pg_installed/data/pg_hba.conf:95)
$ grep -n mygssmap /pg_installed/data/pg_hba.conf
95:host    all             all  0.0.0.0/0  gss map=mygssmap

However, the behavior is not the same for the ones that don’t match the 
mapping in pg_ident.conf: indeed the connection attempt stop here and 
the next HBA line won’t be evaluated.

FATAL:  GSSAPI authentication failed for user "bdt"
DETAIL:  Connection matched pg_hba.conf line 95: "host all             
all  0.0.0.0/0  gss map=mygssmap"

3) Make use of a role in pg_hba.conf, e.g. “+BDTONLY”. That would work 
too, and also allow the evaluation of the next HBA line for the ones 
that are not part of the role.

However:

     - That’s not as dynamic as the regular expression, as new users 
would need to be granted the role and some users who are moving in the 
company may need to have the role revoked.
     - Looking at the regular expression in the HBA file makes it clear 
what filtering needs to be done. This is not obvious when looking at the 
role, even if it has a meaningful name. This can generate “incorrect 
filtering” should one user be granted the role by mistake, or make it 
more difficult to debug why a user is not being matched to a particular 
line in the HBA file.

This is why I think username filtering with regular expressions would 
provide its own advantages.

Thoughts? Looking forward to your feedback,

Regards,

-- 
Bertrand Drouvot
Amazon Web Services: https://aws.amazon.com

--------------I7zu0QyiS2Dm0ZGgptbxEJL2
Content-Type: text/plain; charset="UTF-8";
	name="v1-0001-hba_with_regexp.patch"
Content-Disposition: attachment; filename="v1-0001-hba_with_regexp.patch"
Content-Transfer-Encoding: base64

ZGlmZiAtLWdpdCBhL2RvYy9zcmMvc2dtbC9jbGllbnQtYXV0aC5zZ21sIGIvZG9jL3NyYy9z
Z21sL2NsaWVudC1hdXRoLnNnbWwKaW5kZXggNDMzNzU5OTI4Yi4uZjNkMGJlMjYwYyAxMDA2
NDQKLS0tIGEvZG9jL3NyYy9zZ21sL2NsaWVudC1hdXRoLnNnbWwKKysrIGIvZG9jL3NyYy9z
Z21sL2NsaWVudC1hdXRoLnNnbWwKQEAgLTI0OSw3ICsyNDksOCBAQCBob3N0bm9nc3NlbmMg
IDxyZXBsYWNlYWJsZT5kYXRhYmFzZTwvcmVwbGFjZWFibGU+ICA8cmVwbGFjZWFibGU+dXNl
cjwvcmVwbGFjZWFibAogICAgICAgIFNwZWNpZmllcyB3aGljaCBkYXRhYmFzZSB1c2VyIG5h
bWUocykgdGhpcyByZWNvcmQKICAgICAgICBtYXRjaGVzLiBUaGUgdmFsdWUgPGxpdGVyYWw+
YWxsPC9saXRlcmFsPiBzcGVjaWZpZXMgdGhhdCBpdAogICAgICAgIG1hdGNoZXMgYWxsIHVz
ZXJzLiAgT3RoZXJ3aXNlLCB0aGlzIGlzIGVpdGhlciB0aGUgbmFtZSBvZiBhIHNwZWNpZmlj
Ci0gICAgICAgZGF0YWJhc2UgdXNlciwgb3IgYSBncm91cCBuYW1lIHByZWNlZGVkIGJ5IDxs
aXRlcmFsPis8L2xpdGVyYWw+LgorICAgICAgIGRhdGFiYXNlIHVzZXIsIGEgcmVndWxhciBl
eHByZXNzaW9uIHByZWNlZGVkIGJ5IDxsaXRlcmFsPi88L2xpdGVyYWw+CisgICAgICAgb3Ig
YSBncm91cCBuYW1lIHByZWNlZGVkIGJ5IDxsaXRlcmFsPis8L2xpdGVyYWw+LgogICAgICAg
IChSZWNhbGwgdGhhdCB0aGVyZSBpcyBubyByZWFsIGRpc3RpbmN0aW9uIGJldHdlZW4gdXNl
cnMgYW5kIGdyb3VwcwogICAgICAgIGluIDxwcm9kdWN0bmFtZT5Qb3N0Z3JlU1FMPC9wcm9k
dWN0bmFtZT47IGEgPGxpdGVyYWw+KzwvbGl0ZXJhbD4gbWFyayByZWFsbHkgbWVhbnMKICAg
ICAgICA8cXVvdGU+bWF0Y2ggYW55IG9mIHRoZSByb2xlcyB0aGF0IGFyZSBkaXJlY3RseSBv
ciBpbmRpcmVjdGx5IG1lbWJlcnMKQEAgLTc4NywxNiArNzg4LDE4IEBAIGhvc3QgICAgYWxs
ICAgICAgICAgICAgIGFsbCAgICAgICAgICAgICAxOTIuMTY4LjEyLjEwLzMyICAgICAgICBn
c3MKICMgVFlQRSAgREFUQUJBU0UgICAgICAgIFVTRVIgICAgICAgICAgICBBRERSRVNTICAg
ICAgICAgICAgICAgICBNRVRIT0QKIGhvc3QgICAgYWxsICAgICAgICAgICAgIGFsbCAgICAg
ICAgICAgICAxOTIuMTY4LjAuMC8xNiAgICAgICAgICBpZGVudCBtYXA9b21pY3JvbgogCi0j
IElmIHRoZXNlIGFyZSB0aGUgb25seSB0aHJlZSBsaW5lcyBmb3IgbG9jYWwgY29ubmVjdGlv
bnMsIHRoZXkgd2lsbAorIyBJZiB0aGVzZSBhcmUgdGhlIG9ubHkgZm91ciBsaW5lcyBmb3Ig
bG9jYWwgY29ubmVjdGlvbnMsIHRoZXkgd2lsbAogIyBhbGxvdyBsb2NhbCB1c2VycyB0byBj
b25uZWN0IG9ubHkgdG8gdGhlaXIgb3duIGRhdGFiYXNlcyAoZGF0YWJhc2VzCi0jIHdpdGgg
dGhlIHNhbWUgbmFtZSBhcyB0aGVpciBkYXRhYmFzZSB1c2VyIG5hbWUpIGV4Y2VwdCBmb3Ig
YWRtaW5pc3RyYXRvcnMKLSMgYW5kIG1lbWJlcnMgb2Ygcm9sZSAic3VwcG9ydCIsIHdobyBj
YW4gY29ubmVjdCB0byBhbGwgZGF0YWJhc2VzLiAgVGhlIGZpbGUKLSMgJFBHREFUQS9hZG1p
bnMgY29udGFpbnMgYSBsaXN0IG9mIG5hbWVzIG9mIGFkbWluaXN0cmF0b3JzLiAgUGFzc3dv
cmRzCisjIHdpdGggdGhlIHNhbWUgbmFtZSBhcyB0aGVpciBkYXRhYmFzZSB1c2VyIG5hbWUp
IGV4Y2VwdCBmb3IgYWRtaW5pc3RyYXRvcnMsCisjIHVzZXJzIGZpbmlzaGluZyB3aXRoICJo
ZWxwZGVzayIgYW5kIG1lbWJlcnMgb2Ygcm9sZSAic3VwcG9ydCIsCisjIHdobyBjYW4gY29u
bmVjdCB0byBhbGwgZGF0YWJhc2VzLgorIyBUaGUgZmlsZSRQR0RBVEEvYWRtaW5zIGNvbnRh
aW5zIGEgbGlzdCBvZiBuYW1lcyBvZiBhZG1pbmlzdHJhdG9ycy4gIFBhc3N3b3JkcwogIyBh
cmUgcmVxdWlyZWQgaW4gYWxsIGNhc2VzLgogIwogIyBUWVBFICBEQVRBQkFTRSAgICAgICAg
VVNFUiAgICAgICAgICAgIEFERFJFU1MgICAgICAgICAgICAgICAgIE1FVEhPRAogbG9jYWwg
ICBzYW1ldXNlciAgICAgICAgYWxsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgIG1kNQogbG9jYWwgICBhbGwgICAgICAgICAgICAgQGFkbWlucyAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIG1kNQorbG9jYWwgICBhbGwgICAgICAgICAgICAgL14uKmhl
bHBkZXNrJCAgICAgICAgICAgICAgICAgICAgICAgICAgIG1kNQogbG9jYWwgICBhbGwgICAg
ICAgICAgICAgK3N1cHBvcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1kNQog
CiAjIFRoZSBsYXN0IHR3byBsaW5lcyBhYm92ZSBjYW4gYmUgY29tYmluZWQgaW50byBhIHNp
bmdsZSBsaW5lOgpkaWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQvbGlicHEvaGJhLmMgYi9zcmMv
YmFja2VuZC9saWJwcS9oYmEuYwppbmRleCAxNDQ3NTg4YzRhLi5lNWI5NWVlYmY2IDEwMDY0
NAotLS0gYS9zcmMvYmFja2VuZC9saWJwcS9oYmEuYworKysgYi9zcmMvYmFja2VuZC9saWJw
cS9oYmEuYwpAQCAtNTc0LDcgKzU3NCw4IEBAIGlzX21lbWJlcihPaWQgdXNlcmlkLCBjb25z
dCBjaGFyICpyb2xlKQogfQogCiAvKgotICogQ2hlY2sgQXV0aFRva2VuIGxpc3QgZm9yIGEg
bWF0Y2ggdG8gcm9sZSwgYWxsb3dpbmcgZ3JvdXAgbmFtZXMuCisgKiBDaGVjayBBdXRoVG9r
ZW4gbGlzdCBmb3IgYSBtYXRjaCB0byByb2xlLgorICogV2UgYXJlIGFsbG93aW5nIGdyb3Vw
IG5hbWVzIGFuZCByZWd1bGFyIGV4cHJlc3Npb25zLgogICovCiBzdGF0aWMgYm9vbAogY2hl
Y2tfcm9sZShjb25zdCBjaGFyICpyb2xlLCBPaWQgcm9sZWlkLCBMaXN0ICp0b2tlbnMpCkBA
IC01OTAsNiArNTkxLDU2IEBAIGNoZWNrX3JvbGUoY29uc3QgY2hhciAqcm9sZSwgT2lkIHJv
bGVpZCwgTGlzdCAqdG9rZW5zKQogCQkJaWYgKGlzX21lbWJlcihyb2xlaWQsIHRvay0+c3Ry
aW5nICsgMSkpCiAJCQkJcmV0dXJuIHRydWU7CiAJCX0KKwkJZWxzZSBpZiAoIXRvay0+cXVv
dGVkICYmIHRvay0+c3RyaW5nWzBdID09ICcvJykKKwkJeworCQkJLyoKKwkJCSAqIFdoZW4g
dG9rLT5zdHJpbmcgc3RhcnRzIHdpdGggYSBzbGFzaCwgdHJlYXQgaXQgYXMgYSByZWd1bGFy
CisJCQkgKiBleHByZXNzaW9uLgorCQkJICovCisJCQlpbnQJCQlyOworCQkJcGdfd2NoYXIg
ICAqd3N0cjsKKwkJCWludAkJCXdsZW47CisJCQlyZWdleF90CQlyZTsKKworCQkJd3N0ciA9
IHBhbGxvYygoc3RybGVuKHRvay0+c3RyaW5nICsgMSkgKyAxKSAqIHNpemVvZihwZ193Y2hh
cikpOworCQkJd2xlbiA9IHBnX21iMndjaGFyX3dpdGhfbGVuKHRvay0+c3RyaW5nICsgMSwK
KwkJCQkJCQkJCQl3c3RyLCBzdHJsZW4odG9rLT5zdHJpbmcgKyAxKSk7CisKKwkJCXIgPSBw
Z19yZWdjb21wKCZyZSwgd3N0ciwgd2xlbiwgUkVHX0FEVkFOQ0VELCBDX0NPTExBVElPTl9P
SUQpOworCQkJaWYgKHIpCisJCQl7CisJCQkJY2hhcgkJZXJyc3RyWzEwMF07CisKKwkJCQlw
Z19yZWdlcnJvcihyLCAmcmUsIGVycnN0ciwgc2l6ZW9mKGVycnN0cikpOworCQkJCWVyZXBv
cnQoTE9HLAorCQkJCQkJKGVycmNvZGUoRVJSQ09ERV9JTlZBTElEX1JFR1VMQVJfRVhQUkVT
U0lPTiksCisJCQkJCQkgZXJybXNnKCJpbnZhbGlkIHJlZ3VsYXIgZXhwcmVzc2lvbiBcIiVz
XCI6ICVzIiwKKwkJCQkJCQkJdG9rLT5zdHJpbmcgKyAxLCBlcnJzdHIpKSk7CisKKwkJCQlw
ZnJlZSh3c3RyKTsKKwkJCQlyZXR1cm4gZmFsc2U7CisJCQl9CisJCQllbHNlCisJCQl7CisJ
CQkJcGdfd2NoYXIgICAqd3JvbGVzdHI7CisJCQkJaW50CQkJd3JvbGVsZW47CisKKwkJCQlw
ZnJlZSh3c3RyKTsKKwkJCQl3cm9sZXN0ciA9IHBhbGxvYygoc3RybGVuKHJvbGUpICsgMSkg
KiBzaXplb2YocGdfd2NoYXIpKTsKKwkJCQl3cm9sZWxlbiA9IHBnX21iMndjaGFyX3dpdGhf
bGVuKHJvbGUsIHdyb2xlc3RyLCBzdHJsZW4ocm9sZSkpOworCisJCQkJaWYgKHBnX3JlZ2V4
ZWMoJnJlLCB3cm9sZXN0ciwgd3JvbGVsZW4sIDAsIE5VTEwsIDAsIE5VTEwsIDApID09IFJF
R19PS0FZKQorCQkJCXsKKwkJCQkJcGZyZWUod3JvbGVzdHIpOworCQkJCQlyZXR1cm4gdHJ1
ZTsKKwkJCQl9CisJCQkJZWxzZQorCQkJCXsKKwkJCQkJcGZyZWUod3JvbGVzdHIpOworCQkJ
CQlyZXR1cm4gZmFsc2U7CisJCQkJfQorCQkJfQorCQl9CiAJCWVsc2UgaWYgKHRva2VuX21h
dGNoZXModG9rLCByb2xlKSB8fAogCQkJCSB0b2tlbl9pc19rZXl3b3JkKHRvaywgImFsbCIp
KQogCQkJcmV0dXJuIHRydWU7CmRpZmYgLS1naXQgYS9zcmMvdGVzdC9hdXRoZW50aWNhdGlv
bi90LzAwMV9wYXNzd29yZC5wbCBiL3NyYy90ZXN0L2F1dGhlbnRpY2F0aW9uL3QvMDAxX3Bh
c3N3b3JkLnBsCmluZGV4IDNlMzA3OWM4MjQuLjA5NDM5ZmU4ZTQgMTAwNjQ0Ci0tLSBhL3Ny
Yy90ZXN0L2F1dGhlbnRpY2F0aW9uL3QvMDAxX3Bhc3N3b3JkLnBsCisrKyBiL3NyYy90ZXN0
L2F1dGhlbnRpY2F0aW9uL3QvMDAxX3Bhc3N3b3JkLnBsCkBAIC0yMywxMiArMjMsMTMgQEAg
aWYgKCEkdXNlX3VuaXhfc29ja2V0cykKICMgYW5kIHRoZW4gZXhlY3V0ZSBhIHJlbG9hZCB0
byByZWZyZXNoIGl0Lgogc3ViIHJlc2V0X3BnX2hiYQogewotCW15ICRub2RlICAgICAgID0g
c2hpZnQ7Ci0JbXkgJGhiYV9tZXRob2QgPSBzaGlmdDsKKwlteSAkbm9kZSAgICAgICAJCT0g
c2hpZnQ7CisJbXkgJGhiYV91c2VyX25hbWUgCT0gc2hpZnQ7CisJbXkgJGhiYV9tZXRob2Qg
CQk9IHNoaWZ0OwogCiAJdW5saW5rKCRub2RlLT5kYXRhX2RpciAuICcvcGdfaGJhLmNvbmYn
KTsKIAkjIGp1c3QgZm9yIHRlc3RpbmcgcHVycG9zZXMsIHVzZSBhIGNvbnRpbnVhdGlvbiBs
aW5lCi0JJG5vZGUtPmFwcGVuZF9jb25mKCdwZ19oYmEuY29uZicsICJsb2NhbCBhbGwgYWxs
XFxcbiAkaGJhX21ldGhvZCIpOworCSRub2RlLT5hcHBlbmRfY29uZigncGdfaGJhLmNvbmYn
LCAibG9jYWwgYWxsICRoYmFfdXNlcl9uYW1lXFxcbiAkaGJhX21ldGhvZCIpOwogCSRub2Rl
LT5yZWxvYWQ7CiAJcmV0dXJuOwogfQpAQCAtNzYsMTQgKzc3LDE0IEBAICRFTlZ7IlBHUEFT
U1dPUkQifSA9ICdwYXNzJzsKIAogIyBGb3IgInRydXN0IiBtZXRob2QsIGFsbCB1c2VycyBz
aG91bGQgYmUgYWJsZSB0byBjb25uZWN0LiBUaGVzZSB1c2VycyBhcmUgbm90CiAjIGNvbnNp
ZGVyZWQgdG8gYmUgYXV0aGVudGljYXRlZC4KLXJlc2V0X3BnX2hiYSgkbm9kZSwgJ3RydXN0
Jyk7CityZXNldF9wZ19oYmEoJG5vZGUsICdhbGwnLCAndHJ1c3QnKTsKIHRlc3Rfcm9sZSgk
bm9kZSwgJ3NjcmFtX3JvbGUnLCAndHJ1c3QnLCAwLAogCWxvZ191bmxpa2UgPT4gW3FyL2Nv
bm5lY3Rpb24gYXV0aGVudGljYXRlZDovXSk7CiB0ZXN0X3JvbGUoJG5vZGUsICdtZDVfcm9s
ZScsICd0cnVzdCcsIDAsCiAJbG9nX3VubGlrZSA9PiBbcXIvY29ubmVjdGlvbiBhdXRoZW50
aWNhdGVkOi9dKTsKIAogIyBGb3IgcGxhaW4gInBhc3N3b3JkIiBtZXRob2QsIGFsbCB1c2Vy
cyBzaG91bGQgYWxzbyBiZSBhYmxlIHRvIGNvbm5lY3QuCi1yZXNldF9wZ19oYmEoJG5vZGUs
ICdwYXNzd29yZCcpOworcmVzZXRfcGdfaGJhKCRub2RlLCAnYWxsJywgJ3Bhc3N3b3JkJyk7
CiB0ZXN0X3JvbGUoJG5vZGUsICdzY3JhbV9yb2xlJywgJ3Bhc3N3b3JkJywgMCwKIAlsb2df
bGlrZSA9PgogCSAgW3FyL2Nvbm5lY3Rpb24gYXV0aGVudGljYXRlZDogaWRlbnRpdHk9InNj
cmFtX3JvbGUiIG1ldGhvZD1wYXNzd29yZC9dKTsKQEAgLTkyLDcgKzkzLDcgQEAgdGVzdF9y
b2xlKCRub2RlLCAnbWQ1X3JvbGUnLCAncGFzc3dvcmQnLCAwLAogCSAgW3FyL2Nvbm5lY3Rp
b24gYXV0aGVudGljYXRlZDogaWRlbnRpdHk9Im1kNV9yb2xlIiBtZXRob2Q9cGFzc3dvcmQv
XSk7CiAKICMgRm9yICJzY3JhbS1zaGEtMjU2IiBtZXRob2QsIHVzZXIgInNjcmFtX3JvbGUi
IHNob3VsZCBiZSBhYmxlIHRvIGNvbm5lY3QuCi1yZXNldF9wZ19oYmEoJG5vZGUsICdzY3Jh
bS1zaGEtMjU2Jyk7CityZXNldF9wZ19oYmEoJG5vZGUsICdhbGwnLCAnc2NyYW0tc2hhLTI1
NicpOwogdGVzdF9yb2xlKAogCSRub2RlLAogCSdzY3JhbV9yb2xlJywKQEAgLTExMiw3ICsx
MTMsNyBAQCAkRU5WeyJQR1BBU1NXT1JEIn0gPSAncGFzcyc7CiAKICMgRm9yICJtZDUiIG1l
dGhvZCwgYWxsIHVzZXJzIHNob3VsZCBiZSBhYmxlIHRvIGNvbm5lY3QgKFNDUkFNCiAjIGF1
dGhlbnRpY2F0aW9uIHdpbGwgYmUgcGVyZm9ybWVkIGZvciB0aGUgdXNlciB3aXRoIGEgU0NS
QU0gc2VjcmV0LikKLXJlc2V0X3BnX2hiYSgkbm9kZSwgJ21kNScpOworcmVzZXRfcGdfaGJh
KCRub2RlLCAnYWxsJywgJ21kNScpOwogdGVzdF9yb2xlKCRub2RlLCAnc2NyYW1fcm9sZScs
ICdtZDUnLCAwLAogCWxvZ19saWtlID0+CiAJICBbcXIvY29ubmVjdGlvbiBhdXRoZW50aWNh
dGVkOiBpZGVudGl0eT0ic2NyYW1fcm9sZSIgbWV0aG9kPW1kNS9dKTsKQEAgLTEyMiwxMSAr
MTIzLDExIEBAIHRlc3Rfcm9sZSgkbm9kZSwgJ21kNV9yb2xlJywgJ21kNScsIDAsCiAKICMg
VGVzdHMgZm9yIGNoYW5uZWwgYmluZGluZyB3aXRob3V0IFNTTC4KICMgVXNpbmcgdGhlIHBh
c3N3b3JkIGF1dGhlbnRpY2F0aW9uIG1ldGhvZDsgY2hhbm5lbCBiaW5kaW5nIGNhbid0IHdv
cmsKLXJlc2V0X3BnX2hiYSgkbm9kZSwgJ3Bhc3N3b3JkJyk7CityZXNldF9wZ19oYmEoJG5v
ZGUsICdhbGwnLCAncGFzc3dvcmQnKTsKICRFTlZ7IlBHQ0hBTk5FTEJJTkRJTkcifSA9ICdy
ZXF1aXJlJzsKIHRlc3Rfcm9sZSgkbm9kZSwgJ3NjcmFtX3JvbGUnLCAnc2NyYW0tc2hhLTI1
NicsIDIpOwogIyBTU0wgbm90IGluIHVzZTsgY2hhbm5lbCBiaW5kaW5nIHN0aWxsIGNhbid0
IHdvcmsKLXJlc2V0X3BnX2hiYSgkbm9kZSwgJ3NjcmFtLXNoYS0yNTYnKTsKK3Jlc2V0X3Bn
X2hiYSgkbm9kZSwgJ2FsbCcsICdzY3JhbS1zaGEtMjU2Jyk7CiAkRU5WeyJQR0NIQU5ORUxC
SU5ESU5HIn0gPSAncmVxdWlyZSc7CiB0ZXN0X3JvbGUoJG5vZGUsICdzY3JhbV9yb2xlJywg
J3NjcmFtLXNoYS0yNTYnLCAyKTsKIApAQCAtMTQ1LDcgKzE0Niw3IEBAIGFwcGVuZF90b19m
aWxlKAogISk7CiBjaG1vZCAwNjAwLCAkcGdwYXNzZmlsZSBvciBkaWU7CiAKLXJlc2V0X3Bn
X2hiYSgkbm9kZSwgJ3Bhc3N3b3JkJyk7CityZXNldF9wZ19oYmEoJG5vZGUsICdhbGwnLCAn
cGFzc3dvcmQnKTsKIHRlc3Rfcm9sZSgkbm9kZSwgJ3NjcmFtX3JvbGUnLCAncGFzc3dvcmQg
ZnJvbSBwZ3Bhc3MnLCAwKTsKIHRlc3Rfcm9sZSgkbm9kZSwgJ21kNV9yb2xlJywgICAncGFz
c3dvcmQgZnJvbSBwZ3Bhc3MnLCAyKTsKIApAQCAtMTU2LDQgKzE1Nyw4IEBAIGFwcGVuZF90
b19maWxlKAogCiB0ZXN0X3JvbGUoJG5vZGUsICdtZDVfcm9sZScsICdwYXNzd29yZCBmcm9t
IHBncGFzcycsIDApOwogCisjIFRlc3Rpbmcgd2l0aCByZWd1bGFyIGV4cHJlc3Npb24gZm9y
IHVzZXJuYW1lCityZXNldF9wZ19oYmEoJG5vZGUsICcvXi4qbWQuKiQnLCAncGFzc3dvcmQn
KTsKK3Rlc3Rfcm9sZSgkbm9kZSwgJ21kNV9yb2xlJywgJ3Bhc3N3b3JkIGZyb20gcGdwYXNz
IGFuZCByZWd1bGFyIGV4cHJlc3Npb24gZm9yIHVzZXJuYW1lJywgMCk7CisKIGRvbmVfdGVz
dGluZygpOwo=

--------------I7zu0QyiS2Dm0ZGgptbxEJL2--