Re: CVE-2019-11253: Kubectl/API Server YAML parsing vulnerable to "Billion Laughs" Attack
Sam Fowler <[email protected]> Fri, 11 Oct 2019 18:38:38 +1000
| Newsgroups | gmane.text.yaml.general |
|---|---|
| Organization | Red Hat |
| Message-ID | <[email protected]> |
SGkgeWFtbC1jb3JlIGxpc3QgbWVtYmVycywKCkknbSB3cml0aW5nIHRoaXMgdG8gcmVxdWVzdCBp bnB1dCBvbiB0aGUgcG9zc2liaWxpdHkgb2YgYXNzaWduaW5nIGEgQ1ZFIAp0byB0aGUgWUFNTCBz cGVjIGZvciB0aGUgaXNzdWUgZGVzY3JpYmVkIGluIHRoZSBiZWxvdyBtYWlsIGNoYWluLgoKVGhl IFRMO0RSIGlzOgoKKiBnb3BrZy5pbi95YW1sLnYyIHBhY2thZ2Ugd2FzIHBhdGNoZWQgdG8gYWRk cmVzcyBiZWhhdmlvdXIgdGhhdCBhbGxvd2VkIApmb3IgZXhjZXNzaXZlIHJlc291cmNlIGNvbnN1 bXB0aW9uIChpLmUuIERvUykgb24gY3JhZnRlZCBZQU1MIGlucHV0LgoKKiBUaGlzIHVzYWdlIG9m IGdvcGtnLmluL3lhbWwudjIgaW4ga3ViZXJuZXRlcyB3YXMgYXNzaWduZWQgQ1ZFLTIwMTktMTEy NTMKCiogZ29wa2cuaW4veWFtbC52MiBpcyB1c2VkIGluIG1hbnkgZ29sYW5nIHByb2plY3RzLCBz byBJIHByb3Bvc2VkIAphc3NpZ25pbmcgYSBDVkUgZGlyZWN0bHkgdG8gZ29wa2cuaW4veWFtbC52 MgoKKiBnb3BrZy5pbi95YW1sLnYyIGZvbGxvd3MgdGhlIFlBTUwgc3BlYywgd2hpY2ggZG9lcyBu b3QgbWFrZSBhbnkgCnNlY3VyaXR5IGNvbnNpZGVyYXRpb25zLCBoZW5jZSB0aGlzIG1haWwgZXhw bG9yaW5nIHRoZSBwb3NzaWJpbGl0eSBvZiAKYXNzaWduaW5nIGEgQ1ZFIHRvIHRoZSBZQU1MIHNw ZWMgaW5zdGVhZAoKCkFueSBpbnB1dCBvciBmZWVkYmFjayBpcyBhcHByZWNpYXRlZC4KClRoYW5r cywKLS0KU2FtIEZvd2xlciwgUmVkIEhhdCBQcm9kdWN0IFNlY3VyaXR5CgpPbiAxMS8xMC8xOSA1 OjQyIHBtLCBHdXN0YXZvIE5pZW1leWVyIHdyb3RlOgo+IFNvcnJ5IHRoYXQgdGhpcyBpcyBwYWlu ZnVsLCBidXQgb3B0aW9uIChhKSBpcyB0aGUgb25seSBjb3JyZWN0IG9wdGlvbi4gCj4gSWYgeW91 IGdvIHdpdGggKGMpIHlvdSdsbCBmb3JjZSBtZSB0byBwdWJsaWNseSBleHBsYWluIHdoeSwgd2hp Y2ggaXNuJ3QgCj4gc29tZXRoaW5nIEknbSBrZWVuIG9uIGZvY3VzaW5nIG9uIHJpZ2h0IG5vdy4K PiAKPiAKPiBPbiBGcmksIE9jdCAxMSwgMjAxOSwgMDU6NTUgU2FtIEZvd2xlciA8c2Zvd2xlckBy ZWRoYXQuY29tIAo+IDxtYWlsdG86c2Zvd2xlckByZWRoYXQuY29tPj4gd3JvdGU6Cj4gCj4gICAg IFRoYW5rcyBmb3IgdGhlIHJlcGxpZXMuIFRoZXJlJ3MgY2VydGFpbmx5IGEgZmFpciBjYXNlIHRv IGJlIG1hZGUgdGhhdAo+ICAgICBzaW5jZSB0aGUgeWFtbCBzcGVjIG1ha2VzIG5vIHNlY3VyaXR5 IGNvbnNpZGVyYXRpb25zLCBpdCBpcyBmbGF3ZWQgYW5kCj4gICAgIG1vcmUgZGVzZXJ2aW5nIG9m IENWRSBhc3NpZ25tZW50IHRoYW4gc3BlY2lmaWMgaW1wbGVtZW50YXRpb25zLgo+IAo+ICAgICBJ IHRoZW4gc2VlIHRocmVlIG9wdGlvbnM6Cj4gCj4gICAgIGEpIEFzc2lnbiBhIENWRSB0byB0aGUg WUFNTCBzcGVjCj4gICAgIGIpIEFzc2lnbiBpbmRpdmlkdWFsIENWRXMgdG8gcHJvamVjdHMgdGhh dCB1c2UgZ29wa2cuaW4veWFtbC52Mgo+ICAgICA8aHR0cDovL2dvcGtnLmluL3lhbWwudjI+IGlu IGEKPiAgICAgdnVsbmVyYWJsZSB3YXkKPiAgICAgYykgQXNzaWduIGEgQ1ZFIHRvIGdvcGtnLmlu L3lhbWwudjIgPGh0dHA6Ly9nb3BrZy5pbi95YW1sLnYyPgo+IAo+ICAgICBUaGUgcmVjZW50IHNl dCBvZiBIVFRQLzIgdnVsbmVyYWJpbGl0aWVzWzBdIHRvb2sgYSBzaW1pbGFyIHJvdXRlIHRvCj4g ICAgIG9wdGlvbiBhKSBhbmQgYXNzaWduZWQgZ2VuZXJpYyBDVkVzIGFjcm9zcyBhbGwgaW1wbGVt ZW50YXRpb25zLiBBcwo+ICAgICBzb21lb25lIHdobyB3b3JrZWQgZG93bnN0cmVhbSBvbiB0aGVz ZSBDVkVzLCBteSBvcGluaW9uIGlzIHRoYXQgdGhpcwo+ICAgICB3YXMKPiAgICAgdGhlIHdyb25n IG1vdmUgYW5kIHdhcyBwYXJ0aWN1bGFybHkgY3VtYmVyc29tZSBmb3IgcGllY2VzIG9mIGNvZGUg dGhhdAo+ICAgICB3ZXJlIHZ1bG5lcmFibGUgaW4gbXVsdGlwbGUgd2F5cyAoZS5nLiBib3RoIGRl cGVuZGVudCBvbiBuZXQvaHR0cCBhbmQKPiAgICAgZ1JQQykuCj4gCj4gICAgIE9wdGlvbiBiKSBp cyBmYWlyIGluIHByaW5jaXBsZSwgYnV0IGRvZXMgbm90IHNjYWxlIHdlbGwuIEkgYW0gYXdhcmUg b2YKPiAgICAgYXQgbGVhc3QgMTAwIGRpZmZlcmVudCByZXBvc2l0b3JpZXMgdXNlZCBpbiBSZWQg SGF0IE9wZW5TaGlmdCB0aGF0IGFyZQo+ICAgICBkZXBlbmRlbnQgb24gZ29wa2cuaW4veWFtbC52 MiA8aHR0cDovL2dvcGtnLmluL3lhbWwudjI+IGFuZCBJCj4gICAgIGltYWdpbmUgdGhhdCB0aGVy ZSBhcmUgbWFueSBtb3JlIGluCj4gICAgIHRoZSB3aWxkLiBQb3RlbnRpYWwgaW5kaXZpZHVhbCBD VkUgYXNzaWdubWVudHMgYWRkcyBhIGxvdCBvZiBvdmVyaGVhZAo+ICAgICBmb3IgbGl0dGxlIGJl bmVmaXQsIGluIG15IHZpZXcuCj4gCj4gICAgIFRodXMsIG15IG9waW5pb24gaXMgdGhhdCBvcHRp b24gYykgaXMgdGhlIG1vc3QgcHJhZ21hdGljIGNob2ljZS4gVGhpcwo+ICAgICBjb3VsZCBwb3Rl bnRpYWxseSBsZWFkIHRvIHNpbWlsYXIgQ1ZFcyBpbiBvdGhlciBpbXBsZW1lbnRhdGlvbnMgKGUu Zy4KPiAgICAgbGlieWFtbCwgeWFtbC1jcHAsIHB5eWFtbCwganMteWFtbCkgdGhvdWdoIEkgdGhp bmsgdGhhdCBvdXRjb21lIGlzCj4gICAgIHJlYXNvbmFibGUgYW5kIHdhcnJhbnRlZCBpZiB0aGV5 IGluZGVlZCBleGhpYml0IHRoZSBzYW1lIGJlaGF2aW91ci4KPiAKPiAgICAgSWYgdGhpcyBpcyBh Y2NlcHRhYmxlLCBJIGNhbiBwcm9jZWVkIHdpdGggb3B0aW9uIGEpIGFuZCBhc3NpZ24gYSBDVkUK PiAgICAgZm9yCj4gICAgIGdvcGtnLmluL3lhbWwudjIgPGh0dHA6Ly9nb3BrZy5pbi95YW1sLnYy Pi4KPiAKPiAgICAgW0kgYWxzbyBhZGRlZCBEb3JhbiBNb3BwZXJ0IGZyb20gUmVkIEhhdCB0byBD QyBhcyBhbiBGWUldCj4gCj4gICAgIFRoYW5rcywKPiAgICAgLS0KPiAgICAgU2FtIEZvd2xlciwg UmVkIEhhdCBQcm9kdWN0IFNlY3VyaXR5Cj4gCj4gICAgIFswXSBodHRwczovL3Rvb2xzLmlldGYu b3JnL2h0bWwvcmZjNzU0MCNzZWN0aW9uLTEwLjUKPiAKPiAgICAgT24gMTEvMTAvMTkgMTI6MTMg YW0sIEpvcmRhbiBMaWdnaXR0IHdyb3RlOgo+ICAgICAgPiBNb3ZpbmcgdGhlIGxpc3QgdG8gYmNj LiBUaGlzIHByb2JhYmx5IGlzbid0IHRoYXQgcmVsZXZhbnQgZm9yIGl0Cj4gICAgIGFueXdheQo+ ICAgICAgPiBzaW5jZSBrOHMgYWxyZWFkeSBoYXMgYSBDVkUgY292ZXJpbmcgdGhlIHZ1bG5lcmFi aWxpdHkuCj4gICAgICA+Cj4gICAgICA+IFZ1bG5lcmFiaWxpdHkgaW4gdGhlIHNwZWMgdnMgdnVs bmVyYWJpbGl0eSBpbiBhIGxpYnJhcnkgaXMKPiAgICAgaW50ZXJlc3RpbmcuCj4gICAgICA+Cj4g ICAgICA+IFRoZSBKU09OIFJGQyBleHBsaWNpdGx5IHBlcm1pdHMgcGFyc2VycyB0byBsaW1pdCBu ZXN0aW5nLCBwcmVjaXNpb24sCj4gICAgICA+IHN0cmluZyBzaXplLCBldGMgLSBodHRwczovL3Rv b2xzLmlldGYub3JnL2h0bWwvcmZjNzE1OSNzZWN0aW9uLTkKPiAgICAgID4gVGhlIGh0dHAvMiBS RkMgaGFzIGEgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMKPiAgICAgID4gPGh0dHBzOi8vdG9vbHMu aWV0Zi5vcmcvaHRtbC9yZmM3NTQwI3NlY3Rpb24tMTAuNT4gc2VjdGlvbiB0aGF0Cj4gICAgICA+ IGRlc2NyaWJlcyBhdHRhY2tzIGFuZCBleHBsaWNpdGx5IHBlcm1pdHMgbWl0aWdhdGlvbnMsIGJ1 dCBtYW55Cj4gICAgICA+IGltcGxlbWVudGF0aW9ucyB3ZXJlIHN0aWxsIHZ1bG5lcmFibGUsIGFu ZAo+ICAgICBub24taW1wbGVtZW50YXRpb24tc3BlY2lmaWMKPiAgICAgID4gQ1ZFcyB3ZXJlIG9w ZW5lZCAoaHR0cHM6Ly9rYi5jZXJ0Lm9yZy92dWxzL2lkLzYwNTY0MS8pCj4gICAgICA+IFRoZSB5 YW1sIHNwZWMgPGh0dHBzOi8veWFtbC5vcmcvc3BlYy9jdXJyZW50Lmh0bWw+IGhhcyBubyBzZWN1 cml0eQo+ICAgICAgPiBjb25zaWRlcmF0aW9ucyBzZWN0aW9uIG9yIG5vdGVzIHBlcm1pdHRpbmcg aW1wbGVtZW50ZXJzIHRvIGJvdW5kCj4gICAgICA+IGV4cGFuc2lvbi9kZXB0aCB0aGF0wqBJIGNv dWxkIGZpbmQsIHNvIEknbSBub3Qgc3VyZSB3aGF0IHRoZSBiZXN0Cj4gICAgIGNvdXJzZQo+ICAg ICAgPiBvZiBhY3Rpb24gdGhlcmUgaXMuCj4gICAgICA+IFRoZSBjb3JyZXNwb25kaW5nIFhNTCBl eHBhbnNpb24gdnVsbmVyYWJpbGl0eSBoYXMgYSBDV0UKPiAgICAgID4gKGh0dHBzOi8vY3dlLm1p dHJlLm9yZy9kYXRhL2RlZmluaXRpb25zLzc3Ni5odG1sKSBidXQgbm90IGFuCj4gICAgIG92ZXJh cmNoaW5nCj4gICAgICA+IENWRS4KPiAgICAgID4KPiAgICAgID4KPiAgICAgID4KPiAgICAgID4g T24gVGh1LCBPY3QgMTAsIDIwMTkgYXQgMTA6MDAgQU0gR3VzdGF2byBOaWVtZXllcgo+ICAgICA8 Z3VzdGF2b0BuaWVtZXllci5uZXQgPG1haWx0bzpndXN0YXZvQG5pZW1leWVyLm5ldD4KPiAgICAg ID4gPG1haWx0bzpndXN0YXZvQG5pZW1leWVyLm5ldCA8bWFpbHRvOmd1c3Rhdm9AbmllbWV5ZXIu bmV0Pj4+IHdyb3RlOgo+ICAgICAgPgo+ICAgICAgPsKgIMKgIMKgRm9yIHRoZSByZWNvcmQsIEkn bSBnZXR0aW5nIGFuIGVycm9yIG91dCBvZiB0aGUKPiAgICAgID7CoCDCoCDCoCJrdWJlcm5ldGVz LXNlY3VyaXR5LWRpc2N1c3MiIG1haWxpbmcgbGlzdCwgYmVjYXVzZSBJJ20gbm90Cj4gICAgIHN1 YnNjcmliZWQuCj4gICAgICA+Cj4gICAgICA+wqAgwqAgwqBTbyBub2JvZHkgYnV0IHlvdSBjYW4g c2VlIHRoaXMgcmVwbHkuCj4gICAgICA+Cj4gICAgICA+Cj4gICAgICA+wqAgwqAgwqBPbiBUaHUs IE9jdCAxMCwgMjAxOSBhdCAyOjU4IFBNIEd1c3Rhdm8gTmllbWV5ZXIKPiAgICAgID7CoCDCoCDC oDxndXN0YXZvQG5pZW1leWVyLm5ldCA8bWFpbHRvOmd1c3Rhdm9AbmllbWV5ZXIubmV0Pgo+ICAg ICA8bWFpbHRvOmd1c3Rhdm9AbmllbWV5ZXIubmV0IDxtYWlsdG86Z3VzdGF2b0BuaWVtZXllci5u ZXQ+Pj4gd3JvdGU6Cj4gICAgICA+Cj4gICAgICA+Cj4gICAgICA+wqAgwqAgwqAgwqAgwqBUaGUg Zml4IGZvciB0aGlzIGlzIHRvIG5vdCBhY2NlcHQgY2VydGFpbiB2YWxpZCBkb2N1bWVudHMsIHNv Cj4gICAgICA+wqAgwqAgwqAgwqAgwqB0aGlzIGlzIGEgdnVsbmVyYWJpbGl0eSBpbiB0aGUgc3Bl Y2lmaWNhdGlvbiBtb3JlIHRoYW4gaXQKPiAgICAgaXMgaW4KPiAgICAgID7CoCDCoCDCoCDCoCDC oHRoZSBjb2RlLiBXZSBhcmUgdXNpbmcgaGV1cmlzdGljcyB0byBhdHRlbXB0IHRvIGRyYXcgYSBs aW5lCj4gICAgICA+wqAgwqAgwqAgwqAgwqBiZXR3ZWVuIHdoYXQncyBzb21ldGhpbmcgcmVhc29u YWJsZSBmcm9tIHNvbWV0aGluZyB0aGF0Cj4gICAgIGNvdWxkIGJlCj4gICAgICA+wqAgwqAgwqAg wqAgwqBhYnVzZSBvciBzb21lb25lIGJlaW5nIG5haXZlLiBFdmVuIHdpdGggdGhhdCBpbiBwbGFj ZSwgaWYKPiAgICAgeW91cgo+ICAgICAgPsKgIMKgIMKgIMKgIMKgc3lzdGVtIGFjY2VwdHMgYSBs YXJnZSBlbm91Z2ggWUFNTCBkb2N1bWVudCB5b3UgbWF5IHN0aWxsCj4gICAgIGJlIGluCj4gICAg ICA+wqAgwqAgwqAgwqAgwqB0cm91YmxlLCBiZWNhdXNlIHRoYXQncyB0aGUgbmF0dXJlIG9mIHZh cmlhYmxlIGV4cGFuc2lvbjogaXQKPiAgICAgID7CoCDCoCDCoCDCoCDCoGFsbG93cyB0aGUgZG9j dW1lbnQgdG8gZ3JvdyBub24tbGluZWFybHkgd2l0aCBpdHMgaW5wdXQgc2l6ZS4KPiAgICAgID4K PiAgICAgID7CoCDCoCDCoCDCoCDCoFRoYXQncyBhIGNsYXNzIG9mIHByb2JsZW0gdGhhdCBJIGhh dmVuJ3Qgc2VlbiBDVkVzIGJlaW5nCj4gICAgICA+wqAgwqAgwqAgwqAgwqBhc3NpZ25lZCB0byBi ZWZvcmUsIGFuZCBpdCBzdGlsbCBmZWVscyBzb21ld2hhdCB3cm9uZyBpbiB0aGlzCj4gICAgICA+ wqAgwqAgwqAgwqAgwqBjYXNlLiBXZSdyZSBhZGRyZXNzaW5nIHRoZSBpc3N1ZSwgYnkgdmlvbGF0 aW5nIHRoZQo+ICAgICBzcGVjaWZpY2F0aW9uCj4gICAgICA+wqAgwqAgwqAgwqAgwqBhbmQgcHJl dmVudGluZyBjZXJ0YWluIHZhbGlkIGZpbGVzIGZyb20gYmVpbmcgcGFyc2VkLAo+ICAgICBiYXNl ZCBvbgo+ICAgICAgPsKgIMKgIMKgIMKgIMKgaGV1cmlzdGljcy4gSSdtIHByYWdtYXRpYyBhbmQg aGFwcHkgdG8gY29sbGFib3JhdGUgb24KPiAgICAgdHJ5aW5nIHRvCj4gICAgICA+wqAgwqAgwqAg wqAgwqBwcmV2ZW50IGFidXNlLCBhcyB3ZSBkaWQgaW4gdGhpcyBjYXNlLCBidXQgaWYgeW91IHdh bnQgYQo+ICAgICBDVkUgZm9yCj4gICAgICA+wqAgwqAgwqAgwqAgwqBsaWJyYXJpZXMgaGFuZGxp bmcgZGF0YSBmaWxlcyBwZXIgdGhlIHNwZWNpZmljYXRpb24sIEknbQo+ICAgICBub3QgdGhlCj4g ICAgICA+wqAgwqAgwqAgwqAgwqByaWdodCBwZXJzb24uCj4gICAgICA+Cj4gICAgICA+Cj4gICAg ICA+Cj4gICAgICA+Cj4gICAgICA+Cj4gICAgICA+wqAgwqAgwqAgwqAgwqBPbiBUaHUsIE9jdCAx MCwgMjAxOSBhdCAyOjM1IFBNIEpvcmRhbiBMaWdnaXR0Cj4gICAgICA+wqAgwqAgwqAgwqAgwqA8 bGlnZ2l0dEBnb29nbGUuY29tIDxtYWlsdG86bGlnZ2l0dEBnb29nbGUuY29tPgo+ICAgICA8bWFp bHRvOmxpZ2dpdHRAZ29vZ2xlLmNvbSA8bWFpbHRvOmxpZ2dpdHRAZ29vZ2xlLmNvbT4+PiB3cm90 ZToKPiAgICAgID4KPiAgICAgID7CoCDCoCDCoCDCoCDCoCDCoCDCoEEgQ1ZFIHNwZWNpZmljIHRv IHRoZSB5YW1sIGxpYnJhcnkgbWFrZXMgc2Vuc2UgdG8gbWUuCj4gICAgICA+Cj4gICAgICA+wqAg wqAgwqAgwqAgwqAgwqAgwqBPbiBUaHUsIE9jdCAxMCwgMjAxOSBhdCAxOjUzIEFNIFNhbSBGb3ds ZXIKPiAgICAgID7CoCDCoCDCoCDCoCDCoCDCoCDCoDxzZm93bGVyQHJlZGhhdC5jb20gPG1haWx0 bzpzZm93bGVyQHJlZGhhdC5jb20+Cj4gICAgIDxtYWlsdG86c2Zvd2xlckByZWRoYXQuY29tIDxt YWlsdG86c2Zvd2xlckByZWRoYXQuY29tPj4+IHdyb3RlOgo+ICAgICAgPgo+ICAgICAgPsKgIMKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgSGkgS3ViZXJuZXRlcyBQU0MgKyBnby15YW1sIG1haW50YWlu ZXJzLAo+ICAgICAgPgo+ICAgICAgPsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgUmUgJHN1Ympl Y3RbMF0sIEkgcG9zdGVkIGEgY29tbWVudCBvbiB0aGUgUFIgZm9yIHRoZQo+ICAgICAgPiBnb3Br Zy5pbi95YW1sLnYyIDxodHRwOi8vZ29wa2cuaW4veWFtbC52Mj4gPGh0dHA6Ly9nb3BrZy5pbi95 YW1sLnYyPgo+ICAgICAgPsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgcGF0Y2ggaGVyZVsxXToK PiAgICAgID4KPiAgICAgID4KPiAgICAgID7CoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCJUaGlz IHBhdGNoIHBhcnRseSBjb21wcmlzZXMgdGhlIGs4cyBmaXggZm9yCj4gICAgICA+wqAgwqAgwqAg wqAgwqAgwqAgwqAgwqAgwqBDVkUtMjAxOS0xMTI1Mywgd2hpY2gKPiAgICAgID7CoCDCoCDCoCDC oCDCoCDCoCDCoCDCoCDCoHVwZGF0ZXMgZ29wa2cuaW4veWFtbC52Mgo+ICAgICA8aHR0cDovL2dv cGtnLmluL3lhbWwudjI+IDxodHRwOi8vZ29wa2cuaW4veWFtbC52Mj4gdG8KPiAgICAgID7CoCDC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoHZlcnNpb24gMi4yLjQuIFByZXN1bWFibHkgYW55IHJlcG9z aXRvcnkKPiAgICAgID7CoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHRoYXQgdXNlcyBhbiBlYXJs aWVyIHZlcnNpb24gb2YgZ29wa2cuaW4veWFtbC52Mgo+ICAgICA8aHR0cDovL2dvcGtnLmluL3lh bWwudjI+Cj4gICAgICA+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqA8aHR0cDovL2dvcGtnLmlu L3lhbWwudjI+IGFuZCBhY2NlcHRzIHVudHJ1c3RlZAo+ICAgICAgPsKgIMKgIMKgIMKgIMKgIMKg IMKgIMKgIMKgWUFNTCBpcyBzaW1pbGFybHkgdnVsbmVyYWJsZS4gUmF0aGVyIHRoYW4gYXNzaWdu aW5nCj4gICAgICA+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBpbmRpdmlkdWFsIENWRXMgZm9y Cj4gICAgICA+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBldmVyeSByZXBvIHRoYXQgdXNlcyBn b3BrZy5pbi95YW1sLnYyCj4gICAgIDxodHRwOi8vZ29wa2cuaW4veWFtbC52Mj4KPiAgICAgID7C oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoDxodHRwOi8vZ29wa2cuaW4veWFtbC52Mj4gaW4gYSB2 dWxuZXJhYmxlIHdheSwgSSBhbQo+ICAgICAgPsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgd29u ZGVyaW5nIGlmIGl0IG1ha2VzIG1vcmUgc2Vuc2UgdG8gYXNzaWduIGEgQ1ZFCj4gICAgICA+wqAg wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBkaXJlY3RseSB0bwo+ICAgICAgPiBnb3BrZy5pbi95YW1s LnYyIDxodHRwOi8vZ29wa2cuaW4veWFtbC52Mj4gPGh0dHA6Ly9nb3BrZy5pbi95YW1sLnYyPi4K PiAgICAgID4KPiAgICAgID7CoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoFRoZXJlIGlzIGNlcnRh aW5seSBhbiBhcmd1bWVudCBvZiAiY2F2ZWF0Cj4gICAgIGVtcHRvciI6IHRoYXQKPiAgICAgID4g Z29wa2cuaW4veWFtbC52MiA8aHR0cDovL2dvcGtnLmluL3lhbWwudjI+IDxodHRwOi8vZ29wa2cu aW4veWFtbC52Mj4KPiAgICAgID7CoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHNob3VsZCBub3Qg YmVhciB0aGUgcmVzcG9uc2liaWxpdHkgb2Ygb3RoZXIKPiAgICAgcHJvamVjdHMgdG8KPiAgICAg ID7CoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGFjY2VwdCB1bnRydXN0ZWQKPiAgICAgID7CoCDC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoFlBTUwuIEhvd2V2ZXIsIGFzc2lnbmluZyBhIG5ldyBDVkUg ZGlyZWN0IHRvCj4gICAgICA+IGdvcGtnLmluL3lhbWwudjIgPGh0dHA6Ly9nb3BrZy5pbi95YW1s LnYyPgo+ICAgICA8aHR0cDovL2dvcGtnLmluL3lhbWwudjI+IGFsbG93cyBmb3IKPiAgICAgID7C oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHRob3NlIHByb2plY3RzIHRvIGJlIGFsZXJ0ZWQgb2Yg dGhpcyBwYXRjaCBhbmQKPiAgICAgcG90ZW50aWFsCj4gICAgICA+wqAgwqAgwqAgwqAgwqAgwqAg wqAgwqAgwqB2dWxuZXJhYmlsaXR5LAo+ICAgICAgPsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKg d2hpY2ggaXMgZXNzZW50aWFsbHkgdGhlIHNhbWUgKGkuZS4gYWxsb3dzIGZvcgo+ICAgICBleGNl c3NpdmUKPiAgICAgID7CoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHJlc291cmNlIHVzYWdlCj4g ICAgICA+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqB2aWEgY3JhZnRlZCBZQU1MKS4KPiAgICAg ID4KPiAgICAgID7CoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoEkgY2FuIGFzc2lzdCB3aXRoIENW RSBhc3NpZ25tZW50IGZvcgo+ICAgICBnb3BrZy5pbi95YW1sLnYyIDxodHRwOi8vZ29wa2cuaW4v eWFtbC52Mj4KPiAgICAgID7CoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoDxodHRwOi8vZ29wa2cu aW4veWFtbC52Mj4sIGlmIHRoZXJlIGFyZSBubwo+ICAgICAgPsKgIMKgIMKgIMKgIMKgIMKgIMKg IMKgIMKgb2JqZWN0aW9ucy4iCj4gICAgICA+Cj4gICAgICA+Cj4gICAgICA+wqAgwqAgwqAgwqAg wqAgwqAgwqAgwqAgwqBJIGJlbGlldmUgdGltZWx5IENWRSBhc3NpZ25tZW50IGlzIGFwcHJvcHJp YXRlIGZvcgo+ICAgICAgPiBnb3BrZy5pbi95YW1sLnYyIDxodHRwOi8vZ29wa2cuaW4veWFtbC52 Mj4KPiAgICAgPGh0dHA6Ly9nb3BrZy5pbi95YW1sLnYyPiBhcwo+ICAgICAgPsKgIMKgIMKgIMKg IMKgIMKgIMKgIMKgIMKgSSdtIGF3YXJlIG9mIG1hbnkgcmVwb3MgYW5kIHByb2plY3RzIHRoYXQg dXNlIGl0IChhdAo+ICAgICAgPsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgbGVhc3Qgd2l0aGlu IFJlZAo+ICAgICAgPsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgSGF0KSwgYW5kIHdvdWxkIGxp a2UgdG8gZGVsaXZlciB1cGRhdGVzLiBIb3dldmVyLCBJCj4gICAgICA+wqAgwqAgwqAgwqAgwqAg wqAgwqAgwqAgwqBkb24ndCB3aXNoIHRvCj4gICAgICA+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAg wqBwcm9jZWVkIHdpdGhvdXQgYWdyZWVtZW50IHRoYXQgdGhpcyBpcyB0aGUgcmlnaHQKPiAgICAg YXBwcm9hY2guCj4gICAgICA+Cj4gICAgICA+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBTbywg YXJlIHRoZXJlIGFueSBvYmplY3Rpb25zIGZyb20gdGhlIEt1YmVybmV0ZXMKPiAgICAgUFNDIG9y Cj4gICAgICA+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBnby15YW1sIHRlYW0gdG8KPiAgICAg ID7CoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoGFzc2lnbmluZyBhIENWRSBmb3IgdGhpcyBwYWNr YWdlPwo+ICAgICAgPgo+ICAgICAgPsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgWzBdCj4gICAg IGh0dHBzOi8vZ2l0aHViLmNvbS9rdWJlcm5ldGVzL2t1YmVybmV0ZXMvaXNzdWVzLzgzMjUzCj4g ICAgICA+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBbMV0KPiAgICAgID4gaHR0cHM6Ly9naXRo dWIuY29tL2dvLXlhbWwveWFtbC9wdWxsLzUxNSNpc3N1ZWNvbW1lbnQtNTQwMjQyODU2Cj4gICAg ICA+Cj4gICAgICA+Cj4gICAgICA+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBUaGFua3MsCj4g ICAgICA+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAtLQo+ICAgICAgPsKgIMKgIMKgIMKgIMKg IMKgIMKgIMKgIMKgU2FtIEZvd2xlciwgUmVkIEhhdCBQcm9kdWN0IFNlY3VyaXR5Cj4gICAgICA+ Cj4gICAgICA+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAtLQo+ICAgICAgPsKgIMKgIMKgIMKg IMKgIMKgIMKgIMKgIMKgWW91IHJlY2VpdmVkIHRoaXMgbWVzc2FnZSBiZWNhdXNlIHlvdSBhcmUK PiAgICAgc3Vic2NyaWJlZCB0bwo+ICAgICAgPsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgdGhl IEdvb2dsZSBHcm91cHMgImt1YmVybmV0ZXMtc2VjdXJpdHktZGlzY3VzcyIKPiAgICAgZ3JvdXAu Cj4gICAgICA+wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBUbyB1bnN1YnNjcmliZSBmcm9tIHRo aXMgZ3JvdXAgYW5kIHN0b3AgcmVjZWl2aW5nCj4gICAgIGVtYWlscwo+ICAgICAgPsKgIMKgIMKg IMKgIMKgIMKgIMKgIMKgIMKgZnJvbSBpdCwgc2VuZCBhbiBlbWFpbCB0bwo+ICAgICAgPiBrdWJl cm5ldGVzLXNlY3VyaXR5LWRpc2N1c3MrdW5zdWJzY3JpYmVAZ29vZ2xlZ3JvdXBzLmNvbQo+ICAg ICA8bWFpbHRvOmt1YmVybmV0ZXMtc2VjdXJpdHktZGlzY3VzcyUyQnVuc3Vic2NyaWJlQGdvb2ds ZWdyb3Vwcy5jb20+Cj4gICAgICA+ICAgICAgICAgICAgICAgCj4gICAgICDCoDxtYWlsdG86a3Vi ZXJuZXRlcy1zZWN1cml0eS1kaXNjdXNzJTJCdW5zdWJzY3JpYmVAZ29vZ2xlZ3JvdXBzLmNvbQo+ ICAgICA8bWFpbHRvOmt1YmVybmV0ZXMtc2VjdXJpdHktZGlzY3VzcyUyNTJCdW5zdWJzY3JpYmVA Z29vZ2xlZ3JvdXBzLmNvbT4+Lgo+ICAgICAgPsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgVG8g dmlldyB0aGlzIGRpc2N1c3Npb24gb24gdGhlIHdlYiB2aXNpdAo+ICAgICAgPgo+ICAgICBodHRw czovL2dyb3Vwcy5nb29nbGUuY29tL2QvbXNnaWQva3ViZXJuZXRlcy1zZWN1cml0eS1kaXNjdXNz LzdkMjgzYzViLWY0OWUtOTZjMi03ZDU2LTFlMDhiM2NmYzhhYyU0MHJlZGhhdC5jb20uCj4gICAg ICA+Cj4gICAgICA+Cj4gICAgICA+Cj4gICAgICA+wqAgwqAgwqAgwqAgwqAtLQo+ICAgICAgPgo+ ICAgICAgPsKgIMKgIMKgIMKgIMKgZ3VzdGF2byBAIGh0dHA6Ly9uaWVtZXllci5uZXQKPiAgICAg ID4KPiAgICAgID4KPiAgICAgID4KPiAgICAgID7CoCDCoCDCoC0tCj4gICAgICA+Cj4gICAgICA+ wqAgwqAgwqBndXN0YXZvIEAgaHR0cDovL25pZW1leWVyLm5ldAo+ICAgICAgPgo+IAoKCl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCllhbWwtY29yZSBtYWls aW5nIGxpc3QKWWFtbC1jb3JlQGxpc3RzLnNvdXJjZWZvcmdlLm5ldApodHRwczovL2xpc3RzLnNv dXJjZWZvcmdlLm5ldC9saXN0cy9saXN0aW5mby95YW1sLWNvcmUK