From nobody Tue Dec 1 03:04:31 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 724EF1A8A46 for ; Tue, 1 Dec 2015 03:04:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1TVgAsN3ga45 for ; Tue, 1 Dec 2015 03:04:29 -0800 (PST) Received: from mail-wm0-x230.google.com (mail-wm0-x230.google.com [IPv6:2a00:1450:400c:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B1B231A8A41 for ; Tue, 1 Dec 2015 03:04:28 -0800 (PST) Received: by wmuu63 with SMTP id u63so167690434wmu.0 for ; Tue, 01 Dec 2015 03:04:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-type; bh=MYg9KyL0ADwJvaYmQwJa/TNW7uuJssEnrKnD/aqR2R4=; b=EPdELnykY9xL0yfNdyTJ7eKBc2uH3i1Gb/uopmCe3veYLPxeRbSxrGqFLU4pkrRGib YrsvwiYlqvjqqanNdqf7QZSL2YrgNy6Us3S8pHmh9XooM9Ls7/YDhjLSd1PiCSwsFm7N QYx0ghVELFl3sIWfPTzzEVKniunel8far2T8sJwJ6lBZuo1yLUJAXCJzGCWCGcGgyS6R MvwI5vzE7ajo3y67AAuvjTuys36PnA1opw0K3NsiNjxeTLG0sSez0+LK0Ag1RIUj60cV gc836UOW1VSra7IYWwYQuOk3BZQ4aqKtjCHjMW+RB5htwHmdXuA0mB9UW35s0/WaIOec Epmg== X-Received: by 10.28.222.138 with SMTP id v132mr36148621wmg.23.1448967867262; Tue, 01 Dec 2015 03:04:27 -0800 (PST) Received: from ISOC-A1FD58.local ([92.109.70.118]) by smtp.googlemail.com with ESMTPSA id h67sm25456159wmf.17.2015.12.01.03.04.25 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 01 Dec 2015 03:04:26 -0800 (PST) To: Tim Bruijnzeels , Stephen Kent References: <565617E8.4070005@bbn.com> <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> From: Andrei Robachevsky Message-ID: <565D7EB9.9090902@gmail.com> Date: Tue, 1 Dec 2015 12:04:25 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="2KG7baBiRRpT0GQ9FDwOXnGOgWuaC0kGO" Archived-At: Cc: sidr Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Dec 2015 11:04:30 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --2KG7baBiRRpT0GQ9FDwOXnGOgWuaC0kGO Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Tim Bruijnzeels wrote on 26/11/15 13:29: > Please note that for ROAs there is a requirement that all ROA > prefixes are included on the EE certificate of the (ROA) signed > object CMS. This proposal does not change this. A ROA that has > prefixes that were removed for whatever reason higher in the path > would still become invalid using this algorithm.=20 Tim, I am not sure I understand this. If the parent of the EE cert has a shrunken set of resources, will it invalidate the EE or only the non-overlapping subset? Andrei --2KG7baBiRRpT0GQ9FDwOXnGOgWuaC0kGO Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2 Comment: GPGTools - https://gpgtools.org iEYEARECAAYFAlZdfrkACgkQljz5tZmtij+7kwCfdhsScM9tSd27ZSCrwaxHbNln qxAAoMeFrEjIvkioELKYTOxmXvRCfTh6 =KFTE -----END PGP SIGNATURE----- --2KG7baBiRRpT0GQ9FDwOXnGOgWuaC0kGO-- From nobody Tue Dec 1 05:55:10 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C1141B2DC0 for ; Tue, 1 Dec 2015 05:55:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bmtZo-htXdEd for ; Tue, 1 Dec 2015 05:55:07 -0800 (PST) Received: from mahimahi.ripe.net (mahimahi.ripe.net [IPv6:2001:67c:2e8:11::c100:1372]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 844DA1B2DC8 for ; Tue, 1 Dec 2015 05:55:06 -0800 (PST) Received: from titi.ripe.net ([193.0.23.11]) by mahimahi.ripe.net with esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.84) (envelope-from ) id 1a3lOY-00093H-7z; Tue, 01 Dec 2015 14:55:03 +0100 Received: from sslvpn.ripe.net ([193.0.20.230] helo=vpn-69.ripe.net) by titi.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1a3lOX-00028P-UO; Tue, 01 Dec 2015 14:55:02 +0100 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\)) Content-Type: text/plain; charset=windows-1252 From: Tim Bruijnzeels In-Reply-To: <565D7EB9.9090902@gmail.com> Date: Tue, 1 Dec 2015 14:55:01 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: <81F085EE-8B51-493B-997D-A8D6147105B1@ripe.net> References: <565617E8.4070005@bbn.com> <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> <565D7EB9.9090902@gmail.com> To: Andrei Robachevsky X-Mailer: Apple Mail (2.2104) X-ACL-Warn: Delaying message X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a071948e3e2f0d46905ee401b23e78777e84f Archived-At: Cc: sidr Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Dec 2015 13:55:09 -0000 Hi Andrei > On 01 Dec 2015, at 12:04, Andrei Robachevsky = wrote: >=20 > Tim Bruijnzeels wrote on 26/11/15 13:29: >> Please note that for ROAs there is a requirement that all ROA >> prefixes are included on the EE certificate of the (ROA) signed >> object CMS. This proposal does not change this. A ROA that has >> prefixes that were removed for whatever reason higher in the path >> would still become invalid using this algorithm.=20 >=20 > Tim, I am not sure I understand this. If the parent of the EE cert has = a > shrunken set of resources, will it invalidate the EE or only the > non-overlapping subset? If the parent has a shrunken resource set this would lead to the EE = certificate being accepted only for the intersection of its resources, = and the parent. Because there is a requirement that all prefixes on a = ROA are included (and accepted in reconsidered) in the resource set of = the EE certificate the ROA will be considered invalid. To avoid this it would be better to create one ROA per prefix and avoid = fate sharing. That way only the ROA(s) for the prefix(es) that are no = longer held by the (grand)parent(s) are affected. Tim >=20 > Andrei >=20 From nobody Tue Dec 1 06:42:24 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF0881A9233 for ; Tue, 1 Dec 2015 06:42:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6YTnACNKMsaH for ; Tue, 1 Dec 2015 06:42:18 -0800 (PST) Received: from mail-wm0-x22b.google.com (mail-wm0-x22b.google.com [IPv6:2a00:1450:400c:c09::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F12131A9170 for ; Tue, 1 Dec 2015 06:42:17 -0800 (PST) Received: by wmww144 with SMTP id w144so16224393wmw.0 for ; Tue, 01 Dec 2015 06:42:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-type; bh=A5j3wkq8w404O90YlcoRnncqlH7dsIUMpeCd+L0Okzk=; b=HRnnen2PEpk8rdmewdHDTsM9Aqj/slz1X8pt6e5/iYiP5FaCotaXevqJXuyGGjv1kf ZbwIaj9/Q2VCwlKkhmuMDwnCXDTblRiFLB/B1Lq/RXUXiB4u0LOFM3Wt9Bn/L0OFqSMO G3OtP1BhxZqEPOf9Althzz1Wc2GacK7yeQygYvIYduLhJ9DTZreYDAj2ilm5OHdAYEyr IaCzwAAxTxwkWUSbfldR5EpBRSPzuADK1gzKhK40pj080yp40hgssQNcl/pCb+G1EoTG HXSsQyCUJdxhE+2daT8aCDZgfSN7LDoUVWIzwepej7mi9n7BWfuJkK9V5F2s1EtvGb6U TplA== X-Received: by 10.194.87.201 with SMTP id ba9mr45043153wjb.125.1448980936545; Tue, 01 Dec 2015 06:42:16 -0800 (PST) Received: from ISOC-A1FD58.local ([92.109.70.118]) by smtp.googlemail.com with ESMTPSA id jo6sm51995003wjb.48.2015.12.01.06.42.15 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 01 Dec 2015 06:42:15 -0800 (PST) To: Tim Bruijnzeels References: <565617E8.4070005@bbn.com> <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> <565D7EB9.9090902@gmail.com> <81F085EE-8B51-493B-997D-A8D6147105B1@ripe.net> From: Andrei Robachevsky Message-ID: <565DB1C5.8050802@gmail.com> Date: Tue, 1 Dec 2015 15:42:13 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <81F085EE-8B51-493B-997D-A8D6147105B1@ripe.net> Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="W9afDNxQIalEld7ddmoNhi6GXMxh80t97" Archived-At: Cc: sidr Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Dec 2015 14:42:23 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --W9afDNxQIalEld7ddmoNhi6GXMxh80t97 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Tim Bruijnzeels wrote on 01/12/15 14:55: > Hi Andrei >=20 >> On 01 Dec 2015, at 12:04, Andrei Robachevsky wrote: >> >> Tim Bruijnzeels wrote on 26/11/15 13:29: >>> Please note that for ROAs there is a requirement that all ROA >>> prefixes are included on the EE certificate of the (ROA) signed >>> object CMS. This proposal does not change this. A ROA that has >>> prefixes that were removed for whatever reason higher in the path >>> would still become invalid using this algorithm.=20 >> >> Tim, I am not sure I understand this. If the parent of the EE cert has= a >> shrunken set of resources, will it invalidate the EE or only the >> non-overlapping subset? >=20 > If the parent has a shrunken resource set this would lead to the EE cer= tificate being accepted only for the intersection of its resources, and t= he parent. Because there is a requirement that all prefixes on a ROA are = included (and accepted in reconsidered) in the resource set of the EE cer= tificate the ROA will be considered invalid. >=20 Thank you Tim, this makes sense. Otherwise we will be changing the semantics of ROA, which is tricky. Could you please point me to the place where the requirement is specified? > To avoid this it would be better to create one ROA per prefix and avoid= fate sharing. That way only the ROA(s) for the prefix(es) that are no lo= nger held by the (grand)parent(s) are affected. >=20 Right. Thanks, Andrei > Tim >=20 >> >> Andrei >> >=20 --W9afDNxQIalEld7ddmoNhi6GXMxh80t97 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2 Comment: GPGTools - https://gpgtools.org iEYEARECAAYFAlZdscYACgkQljz5tZmtij/G+ACfRWKfHnfVKp8tSRUHG8yhCw/6 QLIAn2bVbjboVergvwjhJaMaN4WjWeci =AzyS -----END PGP SIGNATURE----- --W9afDNxQIalEld7ddmoNhi6GXMxh80t97-- From nobody Tue Dec 1 08:29:34 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F8B61A044E for ; Tue, 1 Dec 2015 08:29:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RcSOFyxNEoED for ; Tue, 1 Dec 2015 08:29:30 -0800 (PST) Received: from mail-yk0-x231.google.com (mail-yk0-x231.google.com [IPv6:2607:f8b0:4002:c07::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F0FD1A03F9 for ; Tue, 1 Dec 2015 08:29:30 -0800 (PST) Received: by ykdv3 with SMTP id v3so13375021ykd.0 for ; Tue, 01 Dec 2015 08:29:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type:content-transfer-encoding; bh=R0b/DNj7zoLi69Dovny8PRVxUmeCFnQ1kI88iREOJX4=; b=NEQmOkbTozLUE572h8h2meHqi/VOC6ecNbcKgQBgK4501VKLf5QhfAcr0RjYHqVuSN RUfNuiZL01ZB+ITarCNh9dHq2TWHA+RLbNNI6ewhdrLRlfL8jj+6jO99IiH+9XmjMFhE 9axJrdRpzifD386rfjXszAcfvXv57ZWZtCzCVLk3A/33kNgFqIQsHkifdYDGj5/bfTuq NlcJKkeGaiip/JDOAH9xamYme2vKesyOhuCHNt84JToc5IDzNoBwOqtCqPtjsQOlKMRM oDeRJv+354GTsWqfnBEHyhiSRJzsomNwsAiKWskkyKFBadtOVDLvKHnxx5P1oywQl0+d bHBw== MIME-Version: 1.0 X-Received: by 10.129.97.11 with SMTP id v11mr13083155ywb.113.1448987370019; Tue, 01 Dec 2015 08:29:30 -0800 (PST) Sender: christopher.morrow@gmail.com Received: by 10.129.99.9 with HTTP; Tue, 1 Dec 2015 08:29:29 -0800 (PST) In-Reply-To: References: <20151016155343.16008.68230.idtracker@ietfa.amsl.com> Date: Tue, 1 Dec 2015 11:29:29 -0500 X-Google-Sender-Auth: QEspTZneXpf-FxSSft9aveLFe2g Message-ID: From: Christopher Morrow To: "George, Wes" Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: Cc: "sidr@ietf.org" Subject: Re: [sidr] I-D Action: draft-ietf-sidr-as-migration-04.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Dec 2015 16:29:32 -0000 Unless the commentors speak up in the next 2-3 days I'll kick this forward to the IESG for publication... On Fri, Oct 16, 2015 at 12:01 PM, George, Wes w= rote: > I believe that this draft is complete and ready to move forward. This > version addresses AD-review comments received at WGLC, so I think we're > just waiting for it to be resubmitted to IESG for IETF LC, as the changes > made were likely not substantive enough to require a new WGLC. I do *not* > need time to discuss this during the meeting either. > > Thanks, > > Wes > > > > > On 10/16/15, 11:53 AM, "sidr on behalf of internet-drafts@ietf.org" > wrote: > >> >>A New Internet-Draft is available from the on-line Internet-Drafts >>directories. >> This draft is a work item of the Secure Inter-Domain Routing Working >>Group of the IETF. >> >> Title : BGPSec Considerations for AS Migration >> Authors : Wesley George >> Sandy Murphy >>Filename : draft-ietf-sidr-as-migration-04.txt >>Pages : 15 >>Date : 2015-10-16 >> >>Abstract: >> This document discusses considerations and methods for supporting and >> securing a common method for AS-Migration within the BGPSec protocol. >> >> >>The IETF datatracker status page for this draft is: >>https://datatracker.ietf.org/doc/draft-ietf-sidr-as-migration/ >> >>There's also a htmlized version available at: >>https://tools.ietf.org/html/draft-ietf-sidr-as-migration-04 >> >>A diff from the previous version is available at: >>https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-as-migration-04 >> >> >>Please note that it may take a couple of minutes from the time of >>submission >>until the htmlized version and diff are available at tools.ietf.org. >> >>Internet-Drafts are also available by anonymous FTP at: >>ftp://ftp.ietf.org/internet-drafts/ >> >>_______________________________________________ >>sidr mailing list >>sidr@ietf.org >>https://www.ietf.org/mailman/listinfo/sidr > > > ________________________________ > > This E-mail and any of its attachments may contain Time Warner Cable prop= rietary information, which is privileged, confidential, or subject to copyr= ight belonging to Time Warner Cable. This E-mail is intended solely for the= use of the individual or entity to which it is addressed. If you are not t= he intended recipient of this E-mail, you are hereby notified that any diss= emination, distribution, copying, or action taken in relation to the conten= ts of and attachments to this E-mail is strictly prohibited and may be unla= wful. If you have received this E-mail in error, please notify the sender i= mmediately and permanently delete the original and any copy of this E-mail = and any printout. > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From nobody Tue Dec 1 08:38:37 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4DFA1ACDC1 for ; Tue, 1 Dec 2015 08:38:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fAqjD29aJcEk for ; Tue, 1 Dec 2015 08:38:34 -0800 (PST) Received: from mail-yk0-x229.google.com (mail-yk0-x229.google.com [IPv6:2607:f8b0:4002:c07::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2930B1ACDBF for ; Tue, 1 Dec 2015 08:38:34 -0800 (PST) Received: by ykdr82 with SMTP id r82so13603601ykd.3 for ; Tue, 01 Dec 2015 08:38:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type:content-transfer-encoding; bh=ZUk+YpAZzTA42vd5juhSbb/ci7sb5y2XfJdrpWwTcNo=; b=qGAU7Emd9evfnbhtlXlC0cey6u9Y/bNkhjUr4hnfqWkPZNp1NjMrLo91RWV28r8+5m jatGH0MW1goT41DiLf2Nlx3ZC+mrgptTDyBEY1ipWYW6MNydjo+d+g7nhXaacKQa0F9+ AekyepeTnrjfUNs1jQgBDBk0nkcGUzlZ4W5+jovWoOhVnaTe0Y/IJsVnutCyRSO0X1DE Uv14wFXgNf5KynGG2KE9ZyP5HVMyeDpnTxBmpENRHdGaz6V5BKWfoYmNKd4jCK3RDafh Y3fjNPbuE0mjJAeQQZ+rh9f6bCutn7MMiJAWiB2nNZQKfbqBph9q1ICrBrXXPihkwT10 zSxg== MIME-Version: 1.0 X-Received: by 10.129.94.5 with SMTP id s5mr17091152ywb.145.1448987913485; Tue, 01 Dec 2015 08:38:33 -0800 (PST) Sender: christopher.morrow@gmail.com Received: by 10.129.99.9 with HTTP; Tue, 1 Dec 2015 08:38:33 -0800 (PST) In-Reply-To: References: <20151016155343.16008.68230.idtracker@ietfa.amsl.com> Date: Tue, 1 Dec 2015 11:38:33 -0500 X-Google-Sender-Auth: SsLAMVOqbIIr-x31qAc5kSMrSAw Message-ID: From: Christopher Morrow To: "George, Wes" Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: Cc: "sidr@ietf.org" Subject: Re: [sidr] I-D Action: draft-ietf-sidr-as-migration-04.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Dec 2015 16:38:36 -0000 On Tue, Dec 1, 2015 at 11:29 AM, Christopher Morrow wrote: > Unless the commentors speak up in the next 2-3 days I'll kick this > forward to the IESG for publication... For those that like precise dates: dec 3 2015 2200 UTC (or there abouts) > > On Fri, Oct 16, 2015 at 12:01 PM, George, Wes = wrote: >> I believe that this draft is complete and ready to move forward. This >> version addresses AD-review comments received at WGLC, so I think we're >> just waiting for it to be resubmitted to IESG for IETF LC, as the change= s >> made were likely not substantive enough to require a new WGLC. I do *not= * >> need time to discuss this during the meeting either. >> >> Thanks, >> >> Wes >> >> >> >> >> On 10/16/15, 11:53 AM, "sidr on behalf of internet-drafts@ietf.org" >> wrote: >> >>> >>>A New Internet-Draft is available from the on-line Internet-Drafts >>>directories. >>> This draft is a work item of the Secure Inter-Domain Routing Working >>>Group of the IETF. >>> >>> Title : BGPSec Considerations for AS Migration >>> Authors : Wesley George >>> Sandy Murphy >>>Filename : draft-ietf-sidr-as-migration-04.txt >>>Pages : 15 >>>Date : 2015-10-16 >>> >>>Abstract: >>> This document discusses considerations and methods for supporting and >>> securing a common method for AS-Migration within the BGPSec protocol. >>> >>> >>>The IETF datatracker status page for this draft is: >>>https://datatracker.ietf.org/doc/draft-ietf-sidr-as-migration/ >>> >>>There's also a htmlized version available at: >>>https://tools.ietf.org/html/draft-ietf-sidr-as-migration-04 >>> >>>A diff from the previous version is available at: >>>https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-as-migration-04 >>> >>> >>>Please note that it may take a couple of minutes from the time of >>>submission >>>until the htmlized version and diff are available at tools.ietf.org. >>> >>>Internet-Drafts are also available by anonymous FTP at: >>>ftp://ftp.ietf.org/internet-drafts/ >>> >>>_______________________________________________ >>>sidr mailing list >>>sidr@ietf.org >>>https://www.ietf.org/mailman/listinfo/sidr >> >> >> ________________________________ >> >> This E-mail and any of its attachments may contain Time Warner Cable pro= prietary information, which is privileged, confidential, or subject to copy= right belonging to Time Warner Cable. This E-mail is intended solely for th= e use of the individual or entity to which it is addressed. If you are not = the intended recipient of this E-mail, you are hereby notified that any dis= semination, distribution, copying, or action taken in relation to the conte= nts of and attachments to this E-mail is strictly prohibited and may be unl= awful. If you have received this E-mail in error, please notify the sender = immediately and permanently delete the original and any copy of this E-mail= and any printout. >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr From nobody Tue Dec 1 16:33:02 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A087D1B2E75 for ; Tue, 1 Dec 2015 16:33:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0ngQeaRQFkwt for ; Tue, 1 Dec 2015 16:32:59 -0800 (PST) Received: from walnut.tislabs.com (walnut.tislabs.com [192.94.214.200]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 12D641B2E7A for ; Tue, 1 Dec 2015 16:32:59 -0800 (PST) Received: from nova.tislabs.com (unknown [10.66.1.77]) by walnut.tislabs.com (Postfix) with ESMTP id 4134E28B0041; Tue, 1 Dec 2015 19:32:58 -0500 (EST) Received: from cloud.netsec (localhost.localdomain [127.0.0.1]) by nova.tislabs.com (Postfix) with ESMTP id 0C02C1F801E; Tue, 1 Dec 2015 19:32:58 -0500 (EST) Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Content-Type: multipart/signed; boundary="Apple-Mail=_94862A1D-5AAA-4512-97DA-1CAB0724439D"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail 2.5.1 From: Sandra Murphy In-Reply-To: <565DB1C5.8050802@gmail.com> Date: Tue, 1 Dec 2015 19:32:50 -0500 Message-Id: <7C1B79AF-ED56-42AC-9D4F-240F243F779E@tislabs.com> References: <565617E8.4070005@bbn.com> <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> <565D7EB9.9090902@gmail.com> <81F085EE-8B51-493B-997D-A8D6147105B1@ripe.net> <565DB1C5.8050802@gmail.com> To: Andrei Robachevsky X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: sidr , Sandra Murphy Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Dec 2015 00:33:00 -0000 --Apple-Mail=_94862A1D-5AAA-4512-97DA-1CAB0724439D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Speaking as regular ol=92 member: On Dec 1, 2015, at 9:42 AM, Andrei Robachevsky = wrote: > Tim Bruijnzeels wrote on 01/12/15 14:55: >>>=20 >>> Tim, I am not sure I understand this. If the parent of the EE cert = has a >>> shrunken set of resources, will it invalidate the EE or only the >>> non-overlapping subset? >>=20 >> If the parent has a shrunken resource set this would lead to the EE = certificate being accepted only for the intersection of its resources, = and the parent. Because there is a requirement that all prefixes on a = ROA are included (and accepted in reconsidered) in the resource set of = the EE certificate the ROA will be considered invalid. >>=20 >=20 > Thank you Tim, this makes sense. Otherwise we will be changing the > semantics of ROA, which is tricky. Could you please point me to the > place where the requirement is specified? In RFC6483, page 5, section 4. ROA Validation: o The IP address delegation extension [RFC3779] is present in the end-entity (EE) certificate (contained within the ROA), and each IP address prefix(es) in the ROA is contained within the set of IP addresses specified by the EE certificate's IP address delegation extension. Quibble. In the current algorithm, the EE cert that mentioned some of the removed = resources will be invalid. That makes the ROA that mentioned some of = the removed resources be invalid. Under validation reconsidered, the EE cert will be valid, but not all = the resources contained in it will be valid. However, the EE cert still = "contains" the removed resources, so the ROA =93contained within=94 test = would still succeed. So a ROA that mentioned some of the removed = resources would still be considered valid. (I would say that=92s bad.) Under validation-reconsidered, we would need to make sure this section = said something about the validity of the resources in the valid EE cert. Just in case it is not obvious: Suppose the EE cert always contained more resources than the ROA = mentioned. Suppose the ROA did not mention the resources that were removed. In = that case the shrinking of the parent causes a shrinking of the set of = resources that are contained in the EE cert that are considered valid = under validation-reconsidered. The valid subset of the resources = contained in the valid EE cert (i.e., the shrunken resources) would = still cover the resources mentioned in the ROA. So a ROA whose = resources were contained exclusively within the retained resources would = be valid. (I would say that=92s good.) =97Sandy, speaking as regular ol=92 member (We=92ve overloaded =93Valid=94 a couple of different ways valid certs, = valid ROAs, valid origins, valid Signature_Blocks, =85) - it might be = nice to readers and users to come up with a different adjective here for = the subset of the resources that are contained within the certificate, = rather than yet another use of =93valid=94. Before we have to talk = about valid certs with invalid resources.) --Apple-Mail=_94862A1D-5AAA-4512-97DA-1CAB0724439D Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWXjw4AAoJEHplpQeet0IZSj8P/3/ldDhVq7jxGgiqeTGUD3HA StC7QGLyViIYrQuPFbkHwhywU+S3QA3xf6fpu7V3+PcxaOzPtPiKYdJdLLMgxIFS piYArEHQva6y3sFczsTuS6pmWs39xEoO6lNffAn1+8KxLOqlkJrEYK6S856+D68c u0NqdYAi+o9+3dJKxkkdtVuEyo1n7oYbHanHjzIfIl+iibkPFrkA/+oQMnnJNoO/ UCerhrvXniHgTsbsPA8RON5WnoTcfZwUoZCKmk/9beFRL+Ct2kDbD2GO7pJOw0HZ XZSzo6AKl+mNZ6HlXJAx9nKht1wSjObcmvb9SL9OCJFjaaK4Ib/AkTqGuzSVK9nV vm0P3YEhCi3rjtsWbV1jsA/w54x9yvUgcewFvpgrmHtiwmxEGPvSGj9JvHN8QKGV tszp4dDFPuQMopXgBkZNKx5kkY0VyWL5/ZEWtUN9fYxoJJQRGGeO/9cbjX9on3U5 RXIigOl1faBgiRnCUChODikP/+njmoXV2Qjr6dRGK0KwiTuOv4Y1RukZVnjffs2U 5CMqs54De7avFs354Unc8ei5kJh4XW4KKHGENhKsZWVN7QElkA0q+RJijY5gHTsB rNsAXqjNkJgWxgfvh8Z9CkghOpedW+za2MwEjHSgcf3uvoppRszz///L0kh9/j/T uHCzqTjhxvcO+KUu4JXr =oEBi -----END PGP SIGNATURE----- --Apple-Mail=_94862A1D-5AAA-4512-97DA-1CAB0724439D-- From nobody Tue Dec 1 19:18:28 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41C3B1B31F8 for ; Tue, 1 Dec 2015 19:18:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.748 X-Spam-Level: * X-Spam-Status: No, score=1.748 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, MIME_CHARSET_FARAWAY=2.45, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zz-RCVMyGQHa for ; Tue, 1 Dec 2015 19:18:25 -0800 (PST) Received: from mail.zdns.cn (smtp.knet.cn [202.173.10.15]) by ietfa.amsl.com (Postfix) with SMTP id 010011B31F6 for ; Tue, 1 Dec 2015 19:18:24 -0800 (PST) X-TM-DID: 566918dbf926d792dbced61642d2eff1 Content-Type: text/plain; charset=gb2312 Mime-Version: 1.0 (Mac OS X Mail 9.1 \(3096.5\)) From: Declan Ma In-Reply-To: <7C1B79AF-ED56-42AC-9D4F-240F243F779E@tislabs.com> Date: Wed, 2 Dec 2015 11:18:04 +0800 Content-Transfer-Encoding: quoted-printable Message-Id: References: <565617E8.4070005@bbn.com> <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> <565D7EB9.9090902@gmail.com> <81F085EE-8B51-493B-997D-A8D6147105B1@ripe.net> <565DB1C5.8050802@gmail.com> <7C1B79AF-ED56-42AC-9D4F-240F243F779E@tislabs.com> To: Sandra Murphy X-Mailer: Apple Mail (2.3096.5) Archived-At: Cc: sidr Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Dec 2015 03:18:27 -0000 > =D4=DA 2015=C4=EA12=D4=C22=C8=D5=A3=AC08:32=A3=ACSandra Murphy = =D0=B4=B5=C0=A3=BA >=20 > (We=A1=AFve overloaded =A1=B0Valid=A1=B1 a couple of different ways = valid certs, valid ROAs, valid origins, valid Signature_Blocks, =A1=AD) = - it might be nice to readers and users to come up with a different = adjective here for the subset of the resources that are contained within = the certificate, rather than yet another use of =A1=B0valid=A1=B1. = Before we have to talk about valid certs with invalid resources.) Quite reasonable. According to the discussions on Validation Reconsidered during the past = few days, I think we need precise terminology. And documenting = well-defined security problems is yet another critical thing.=20 Di= From nobody Wed Dec 2 00:23:01 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8B0F1B33FF for ; Wed, 2 Dec 2015 00:23:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qqG5gk29cuDq for ; Wed, 2 Dec 2015 00:22:59 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95EE41B3327 for ; Wed, 2 Dec 2015 00:22:59 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.82) (envelope-from ) id 1a42gh-00051j-I8; Wed, 02 Dec 2015 08:22:55 +0000 Date: Wed, 02 Dec 2015 17:22:53 +0900 Message-ID: From: Randy Bush To: Christopher Morrow In-Reply-To: References: <20151016155343.16008.68230.idtracker@ietfa.amsl.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Cc: "sidr@ietf.org" Subject: Re: [sidr] I-D Action: draft-ietf-sidr-as-migration-04.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Dec 2015 08:23:00 -0000 > Unless the commentors speak up in the next 2-3 days I'll kick this > forward to the IESG for publication... go for it randy From nobody Wed Dec 2 02:23:46 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A2B41A86FF for ; Wed, 2 Dec 2015 02:23:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3lcSI9O9tr9A for ; Wed, 2 Dec 2015 02:23:42 -0800 (PST) Received: from mail-pa0-x233.google.com (mail-pa0-x233.google.com [IPv6:2607:f8b0:400e:c03::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97CCE1A8701 for ; Wed, 2 Dec 2015 02:23:42 -0800 (PST) Received: by pacdm15 with SMTP id dm15so36945509pac.3 for ; Wed, 02 Dec 2015 02:23:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=UnB9q8SiYFUgs2y28foA5gGWIREH21ZRsVRYzc9x6+o=; b=diB7tovldiXArlS4QNOp9f+3TXww5eGXsleKSWyUi+6XWN8aCBUEsbiiiPHQV60qIa JN91yAqe+/auXlv2HGDYojB0748Y6OtTjtTvZHsJaKSY/5s+5kYGcynJcZxQqXukozpV QGTxwsbkyC0GQyMJkyntTBy/nhss2+oPCRjjVoVMVvXGYkq6wr5PJl9V4N6/J5ftIbbh 1hjJaarrzHuRn9AlOf2QVnJMN4gQJoIPSaH5VYPfA+2mzujdP+u9ZVtq2LmKDNuMr0Pb 84flgYJG7n6odxBZRzdjmN0Uq3CwkhBXfcw5+qYFGf4xEqfVoRTJX6Pm9pIlhhtYctje F79g== X-Received: by 10.98.13.200 with SMTP id 69mr3370666pfn.165.1449051822173; Wed, 02 Dec 2015 02:23:42 -0800 (PST) Received: from 2001-44b8-1121-1a00-dca1-44d5-50a7-5569.static.ipv6.internode.on.net (2001-44b8-1121-1a00-dca1-44d5-50a7-5569.static.ipv6.internode.on.net. [2001:44b8:1121:1a00:dca1:44d5:50a7:5569]) by smtp.gmail.com with ESMTPSA id 25sm3379309pfp.62.2015.12.02.02.23.39 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 02 Dec 2015 02:23:41 -0800 (PST) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.1 \(3096.5\)) From: Geoff Huston In-Reply-To: <7C1B79AF-ED56-42AC-9D4F-240F243F779E@tislabs.com> Date: Wed, 2 Dec 2015 21:23:37 +1100 Content-Transfer-Encoding: quoted-printable Message-Id: <29702B8D-B96A-4361-AB45-A1649B0CD3C2@gmail.com> References: <565617E8.4070005@bbn.com> <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> <565D7EB9.9090902@gmail.com> <81F085EE-8B51-493B-997D-A8D6147105B1@ripe.net> <565DB1C5.8050802@gmail.com> <7C1B79AF-ED56-42AC-9D4F-240F243F779E@tislabs.com> To: Sandra Murphy X-Mailer: Apple Mail (2.3096.5) Archived-At: Cc: sidr Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Dec 2015 10:23:44 -0000 > On 2 Dec 2015, at 11:32 AM, Sandra Murphy wrote: >=20 > Speaking as regular ol=92 member: >=20 > On Dec 1, 2015, at 9:42 AM, Andrei Robachevsky = wrote: >=20 >> Tim Bruijnzeels wrote on 01/12/15 14:55: >>>>=20 >>>> Tim, I am not sure I understand this. If the parent of the EE cert = has a >>>> shrunken set of resources, will it invalidate the EE or only the >>>> non-overlapping subset? >>>=20 >>> If the parent has a shrunken resource set this would lead to the EE = certificate being accepted only for the intersection of its resources, = and the parent. Because there is a requirement that all prefixes on a = ROA are included (and accepted in reconsidered) in the resource set of = the EE certificate the ROA will be considered invalid. >>>=20 >>=20 >> Thank you Tim, this makes sense. Otherwise we will be changing the >> semantics of ROA, which is tricky. Could you please point me to the >> place where the requirement is specified? >=20 > In RFC6483, page 5, section 4. ROA Validation: >=20 > o The IP address delegation extension [RFC3779] is present in the > end-entity (EE) certificate (contained within the ROA), and each > IP address prefix(es) in the ROA is contained within the set of = IP > addresses specified by the EE certificate's IP address delegation > extension. >=20 > Quibble. RFC6482, section 4 >=20 > In the current algorithm, the EE cert that mentioned some of the = removed resources will be invalid. That makes the ROA that mentioned = some of the removed resources be invalid. >=20 > Under validation reconsidered, the EE cert will be valid, but not all = the resources contained in it will be valid. However, the EE cert still = "contains" the removed resources, so the ROA =93contained within=94 test = would still succeed. So a ROA that mentioned some of the removed = resources would still be considered valid. (I would say that=92s bad.) I=92d say thats bad too. So how about an example or two: Example 1: A CA Cert: 1.0.0.0/24, 2.0.0.0/24 issues: B CA Cert: 1.0.0.0/24, 2.0.0.0/24, 3.0.0.0/24 issues: C EE Cert: 1.0.0.0/24 and signs ROA: 1.0.0.0/24 AS1 all good (assuming that A is a trust anchor) Example 2: A CA Cert: 1.0.0.0/24, 2.0.0.0/24 issues: B CA Cert: 1.0.0.0/24, 2.0.0.0/24, 3.0.0.0/24 issues: C EE Cert: 1.0.0.0/24, 2.0.0.0/24 and signs ROA: 1.0.0.0/24 AS1 still all good (assuming that A is a trust anchor) Example 3: A CA Cert: 1.0.0.0/24, 2.0.0.0/24 issues: B CA Cert: 1.0.0.0/24, 2.0.0.0/24, 3.0.0.0/24 issues: C EE Cert: 1.0.0.0/24, 3.0.0.0/24 and signs ROA: 1.0.0.0/24 AS1 still all good (assuming that A is a trust anchor) Example 4: A CA Cert: 1.0.0.0/24, 2.0.0.0/24 issues: B CA Cert: 1.0.0.0/24, 2.0.0.0/24, 3.0.0.0/24 issues: C EE Cert: 1.0.0.0/24, 3.0.0.0/24 and signs ROA: 1.0.0.0/24, 3.0.0.0/24 AS1 invalid ROA (or at least that=92s my opinion of what should happen. My assumption = here is that the ROA IS intentionally a collection of resources where = the entirety of the collection is important, so if all elements of the = collection cannot be validated via the ROA=92s EE certificate then its a = dud ROA.) >=20 > Under validation-reconsidered, we would need to make sure this section = said something about the validity of the resources in the valid EE cert. I don=92t think its a question of the EE cert, but the question of = section 4 of RFC6482 and what validation of the ROA means. >=20 > Just in case it is not obvious: >=20 > Suppose the EE cert always contained more resources than the ROA = mentioned. which is ok today under RFC6482 >=20 > Suppose the ROA did not mention the resources that were removed. In = that case the shrinking of the parent causes a shrinking of the set of = resources that are contained in the EE cert that are considered valid = under validation-reconsidered. The valid subset of the resources = contained in the valid EE cert (i.e., the shrunken resources) would = still cover the resources mentioned in the ROA. So a ROA whose = resources were contained exclusively within the retained resources would = be valid. (I would say that=92s good.) i.e. thats like my example 3 above, so I agree thats good from where I = sit as well. >=20 > =97Sandy, speaking as regular ol=92 member >=20 > (We=92ve overloaded =93Valid=94 a couple of different ways valid = certs, valid ROAs, valid origins, valid Signature_Blocks, =85) - it = might be nice to readers and users to come up with a different adjective = here for the subset of the resources that are contained within the = certificate, rather than yet another use of =93valid=94. Before we = have to talk about valid certs with invalid resources.) >=20 From nobody Wed Dec 2 10:29:01 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 497081ACE0B for ; Wed, 2 Dec 2015 10:28:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DACMtxHnAJ1A for ; Wed, 2 Dec 2015 10:28:57 -0800 (PST) Received: from walnut.tislabs.com (walnut.tislabs.com [192.94.214.200]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DFC61ACE07 for ; Wed, 2 Dec 2015 10:28:57 -0800 (PST) Received: from nova.tislabs.com (unknown [10.66.1.77]) by walnut.tislabs.com (Postfix) with ESMTP id 9EA3528B0041; Wed, 2 Dec 2015 13:28:55 -0500 (EST) Received: from cloud.netsec (localhost.localdomain [127.0.0.1]) by nova.tislabs.com (Postfix) with ESMTP id 81B361F801E; Wed, 2 Dec 2015 13:28:55 -0500 (EST) Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Content-Type: multipart/signed; boundary="Apple-Mail=_075D3106-23CA-46F8-AFEC-FB9243F17500"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail 2.5.1 From: Sandra Murphy In-Reply-To: <29702B8D-B96A-4361-AB45-A1649B0CD3C2@gmail.com> Date: Wed, 2 Dec 2015 13:28:46 -0500 Message-Id: References: <565617E8.4070005@bbn.com> <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> <565D7EB9.9090902@gmail.com> <81F085EE-8B51-493B-997D-A8D6147105B1@ripe.net> <565DB1C5.8050802@gmail.com> <7C1B79AF-ED56-42AC-9D4F-240F243F779E@tislabs.com> <29702B8D-B96A-4361-AB45-A1649B0CD3C2@gmail.com> To: Geoff Huston X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: sidr , Sandra Murphy Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Dec 2015 18:28:59 -0000 --Apple-Mail=_075D3106-23CA-46F8-AFEC-FB9243F17500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 On Dec 2, 2015, at 5:23 AM, Geoff Huston wrote: >=20 >> On 2 Dec 2015, at 11:32 AM, Sandra Murphy wrote: >>=20 >> Speaking as regular ol=92 member: >>=20 >> On Dec 1, 2015, at 9:42 AM, Andrei Robachevsky = wrote: >>=20 >>=20 >> In RFC6483, page 5, section 4. ROA Validation: >>=20 >> o The IP address delegation extension [RFC3779] is present in the >> end-entity (EE) certificate (contained within the ROA), and each >> IP address prefix(es) in the ROA is contained within the set of = IP >> addresses specified by the EE certificate's IP address delegation >> extension. >>=20 >> Quibble. >=20 > RFC6482, section 4 Yep, my bad, that=92s a typo, the quote is from RFC6482. Sorry about = that. Attempt to be precise and miss a point. Hate that. >=20 >>=20 >> In the current algorithm, the EE cert that mentioned some of the = removed resources will be invalid. That makes the ROA that mentioned = some of the removed resources be invalid. >>=20 >> Under validation reconsidered, the EE cert will be valid, but not all = the resources contained in it will be valid. However, the EE cert still = "contains" the removed resources, so the ROA =93contained within=94 test = would still succeed. So a ROA that mentioned some of the removed = resources would still be considered valid. (I would say that=92s bad.) >=20 >=20 > I=92d say thats bad too. >=20 > So how about an example or two: >=20 <=85> >=20 > Example 4: >=20 > A CA Cert: 1.0.0.0/24, 2.0.0.0/24 >=20 > issues: >=20 > B CA Cert: 1.0.0.0/24, 2.0.0.0/24, 3.0.0.0/24 >=20 > issues: >=20 > C EE Cert: 1.0.0.0/24, 3.0.0.0/24 >=20 > and signs >=20 > ROA: 1.0.0.0/24, 3.0.0.0/24 AS1 >=20 > invalid ROA >=20 > (or at least that=92s my opinion of what should happen. My assumption = here is that the ROA IS intentionally a collection of resources where = the entirety of the collection is important, so if all elements of the = collection cannot be validated via the ROA=92s EE certificate then its a = dud ROA.) That=92s not my understanding of what the text currently says will = happen. Note that I am not disagreeing that this is the desired result. = (I did say =93that=92s bad=94, above, remember.) By my understanding of validation-reconsidered, the C EE cert would be = valid but the valid resources in the valid C EE cert would be only = 1.0.0.0/24. The actual text of RFC6482 says that the =93each IP address prefix(es) = in the ROA is contained within the set of IP addresses specified by the = EE certificate's IP address delegation extension.=94 Set 1: "each IP address prefix(es) in the ROA" : 1.0.0.0/24, 3.0.0.0/24 = AS1 Set 2: "the set of IP addresses specified by the EE certificate's IP = address delegation extension": 1.0.0.0/24, 3.0.0.0/24 is set1 contained within set2? Yes. So (under validation-reconsidered) the ROA meets the RFC6482 condition, = as the text currently stands. So the ROA would be valid. >=20 >>=20 >> Under validation-reconsidered, we would need to make sure this = section said something about the validity of the resources in the valid = EE cert. >=20 >=20 > I don=92t think its a question of the EE cert, but the question of = section 4 of RFC6482 and what validation of the ROA means. Under validation-reconsidered, I would say that the ROA should be valid = if the IP addresses it contains are contained within the *valid* = resources among the resources specified in the EE cert. We need to say that because the valid resources specified in a valid EE = cert could be a proper subset of the resources specified in the EE cert. = As your examples show. Just =93contained within=94 is not going to be = sufficient specification. No biggie, just a need for more precise text, under = validation-reconsidered. >> Suppose the ROA did not mention the resources that were removed. In = that case the shrinking of the parent causes a shrinking of the set of = resources that are contained in the EE cert that are considered valid = under validation-reconsidered. The valid subset of the resources = contained in the valid EE cert (i.e., the shrunken resources) would = still cover the resources mentioned in the ROA. So a ROA whose = resources were contained exclusively within the retained resources would = be valid. (I would say that=92s good.) >=20 >=20 > i.e. thats like my example 3 above, so I agree thats good from where I = sit as well. Good, then I=92ve got that much of validation-reconsidered right. =97Sandy --Apple-Mail=_075D3106-23CA-46F8-AFEC-FB9243F17500 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWXzhmAAoJEHplpQeet0IZ0+wP/AyXyfJLP32v/R0YMlyXhqP1 1Rs0T/4oOvY5r/MjpHoNzMQuREmiOEpyODt4Gyq/sZY/E64Q+GAKDsUrGkibaCLX W5MwPTMyj6tBsuCfPHFYsW6OkFBPCXhngKt/33aH/+FzeEeO8eXOih9z0h03OoI5 dRNVcSOWanOG9re5FX7AqouhP37EjaZiCfSkRYOtznH4IFpWttHOsm564t1TBHLr hBy2IARW1nbdhgUotVEnJjjLEbUf23OyS/MKPVm5NoCL3tlj8PN2mjrO6HeF4NzI W1ztmNpaTXkN3oe7/Q4vyAtZi+G4bmHOtszaiMvdux6VkNN7rEtv0W4owec/+J32 KIx3xi6zi9T4Iv0MRZo99Pbls+rMq6S3QodVi+/IXwTZoMkn0Q7o3SFNZTCjEFc6 0//5Xkko5XQPfK+JsmSR60uz38oSc56uksYHjjdRVJn3oKTXwXB4+RHSFCjkbQUj Ehu0p4JxraacDce4Z60ELuzj4dHRA5oXmTk4ytK7BYoYco1JMlf4s77fSvk+AQNP AtAT+wXoMoaEA0hqBl3CzKwloPgDw8vojC/3Ra332aMdvfKBkyfm2FUoLB/fPls8 jiotVozRVzJcEJ10Rj9VD0HCj/v9Keosy4ZVDCN3e6s0PqY4tJbMrCVt00pfVB/l NX2xSHuOXzqv/vLJ9WbF =xw4T -----END PGP SIGNATURE----- --Apple-Mail=_075D3106-23CA-46F8-AFEC-FB9243F17500-- From nobody Wed Dec 2 12:49:25 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 058431B2D1C for ; Wed, 2 Dec 2015 12:49:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mhVA-Xcad7Dy for ; Wed, 2 Dec 2015 12:49:23 -0800 (PST) Received: from mail-pf0-x22d.google.com (mail-pf0-x22d.google.com [IPv6:2607:f8b0:400e:c00::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D58A11B2D16 for ; Wed, 2 Dec 2015 12:49:22 -0800 (PST) Received: by pfu207 with SMTP id 207so1743202pfu.2 for ; Wed, 02 Dec 2015 12:49:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=W0klqNW739uXh5MxnpPC03VnJh3eyh/S2plI/MYt9Ws=; b=CZbnakvYhSP4Rkz563VGFJZPeWOiNtqAO/Fw0f8o0Z4d7JhuV8D0OwUiAlg+Gu+6cN nOlYt1+k//lO/BUDXfcDeOmhP4wm9NEFWALnPPvydqqzdfVGzsK2LZfREKumEBWKKUEc dkAWjwBIJ40Lu6izF9+bZM7JR2fyoMIj3LVxh02tH/EQwMgFJyr/Le0nNhrLwM4ayT4u N2kApmVetSz/qBQVjMDrum0ztgAIsdO9c6WJgis1bdHb4J7dxIZ0aqB/85WpqwSTr6lF RAmQg16yCi/2Hg6zeZgKbqW3tb2GR2lpd9jtZc7W45dgV6jbBbcKoDdkG6mXZvyV+kV+ 8XDQ== X-Received: by 10.98.0.195 with SMTP id 186mr7718702pfa.130.1449089362563; Wed, 02 Dec 2015 12:49:22 -0800 (PST) Received: from [10.3.6.226] ([119.225.153.211]) by smtp.gmail.com with ESMTPSA id 62sm6092736pfl.90.2015.12.02.12.49.20 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 02 Dec 2015 12:49:22 -0800 (PST) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 9.1 \(3096.5\)) From: Geoff Huston In-Reply-To: Date: Thu, 3 Dec 2015 07:49:17 +1100 Content-Transfer-Encoding: quoted-printable Message-Id: References: <565617E8.4070005@bbn.com> <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> <565D7EB9.9090902@gmail.com> <81F085EE-8B51-493B-997D-A8D6147105B1@ripe.net> <565DB1C5.8050802@gmail.com> <7C1B79AF-ED56-42AC-9D4F-240F243F779E@tislabs.com> <29702B8D-B96A-4361-AB45-A1649B0CD3C2@gmail.com> To: Sandra Murphy X-Mailer: Apple Mail (2.3096.5) Archived-At: Cc: sidr Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Dec 2015 20:49:25 -0000 > On 3 Dec 2015, at 5:28 AM, Sandra Murphy wrote: >=20 >=20 > On Dec 2, 2015, at 5:23 AM, Geoff Huston wrote: >=20 >>=20 >>> On 2 Dec 2015, at 11:32 AM, Sandra Murphy wrote: >>>=20 >>> Speaking as regular ol=92 member: >>>=20 >>> On Dec 1, 2015, at 9:42 AM, Andrei Robachevsky = wrote: >>>=20 >>>=20 >>> In RFC6483, page 5, section 4. ROA Validation: >>>=20 >>> o The IP address delegation extension [RFC3779] is present in the >>> end-entity (EE) certificate (contained within the ROA), and each >>> IP address prefix(es) in the ROA is contained within the set of = IP >>> addresses specified by the EE certificate's IP address delegation >>> extension. >>>=20 >>> Quibble. >>=20 >> RFC6482, section 4 >=20 > Yep, my bad, that=92s a typo, the quote is from RFC6482. Sorry about = that. >=20 > Attempt to be precise and miss a point. Hate that. I do it all the time. sigh. >=20 >>=20 >>>=20 >>> In the current algorithm, the EE cert that mentioned some of the = removed resources will be invalid. That makes the ROA that mentioned = some of the removed resources be invalid. >>>=20 >>> Under validation reconsidered, the EE cert will be valid, but not = all the resources contained in it will be valid. However, the EE cert = still "contains" the removed resources, so the ROA =93contained within=94 = test would still succeed. So a ROA that mentioned some of the removed = resources would still be considered valid. (I would say that=92s bad.) >>=20 >>=20 >> I=92d say thats bad too. >>=20 >> So how about an example or two: >>=20 > <=85> >=20 >>=20 >> Example 4: >>=20 >> A CA Cert: 1.0.0.0/24, 2.0.0.0/24 >>=20 >> issues: >>=20 >> B CA Cert: 1.0.0.0/24, 2.0.0.0/24, 3.0.0.0/24 >>=20 >> issues: >>=20 >> C EE Cert: 1.0.0.0/24, 3.0.0.0/24 >>=20 >> and signs >>=20 >> ROA: 1.0.0.0/24, 3.0.0.0/24 AS1 >>=20 >> invalid ROA >>=20 >> (or at least that=92s my opinion of what should happen. My assumption = here is that the ROA IS intentionally a collection of resources where = the entirety of the collection is important, so if all elements of the = collection cannot be validated via the ROA=92s EE certificate then its a = dud ROA.) >=20 > That=92s not my understanding of what the text currently says will = happen. Note that I am not disagreeing that this is the desired result. = (I did say =93that=92s bad=94, above, remember.) >=20 > By my understanding of validation-reconsidered, the C EE cert would be = valid but the valid resources in the valid C EE cert would be only = 1.0.0.0/24. >=20 > The actual text of RFC6482 says that the =93each IP address prefix(es) = in the ROA is contained within the set of IP addresses specified by the = EE certificate's IP address delegation extension.=94 >=20 > Set 1: "each IP address prefix(es) in the ROA" : 1.0.0.0/24, = 3.0.0.0/24 AS1 >=20 > Set 2: "the set of IP addresses specified by the EE certificate's IP = address delegation extension": 1.0.0.0/24, 3.0.0.0/24 >=20 > is set1 contained within set2? Yes. >=20 > So (under validation-reconsidered) the ROA meets the RFC6482 = condition, as the text currently stands. So the ROA would be valid. That=92s a good point, and in my world that=92s not the desired outcome. = Which implies that a revision of the validation algorithm should have = something to say about the set of number resources in an EE certificate = that can be considered - informally each of the =93good=94 resources in = an EE cert must be present in each of the CA certs in the validation = path. And secondly it should specifically consider ROAs, and possibly = considere the more generic case and consider whether the =93bundle=94 of = resources is a critical element of the signed attestation. My intuitive = reaction is that a ROA is an =93all or nothing=94 prospect, so you can=92t= have a valid ROA with a subset of INRs listed in the ROA, but others = may see it differently. >=20 >>=20 >>>=20 >>> Under validation-reconsidered, we would need to make sure this = section said something about the validity of the resources in the valid = EE cert. >>=20 >>=20 >> I don=92t think its a question of the EE cert, but the question of = section 4 of RFC6482 and what validation of the ROA means. >=20 > Under validation-reconsidered, I would say that the ROA should be = valid if the IP addresses it contains are contained within the *valid* = resources among the resources specified in the EE cert. >=20 > We need to say that because the valid resources specified in a valid = EE cert could be a proper subset of the resources specified in the EE = cert. As your examples show. Just =93contained within=94 is not going = to be sufficient specification. >=20 > No biggie, just a need for more precise text, under = validation-reconsidered. agreed by me at any rate. >=20 >=20 >>> Suppose the ROA did not mention the resources that were removed. In = that case the shrinking of the parent causes a shrinking of the set of = resources that are contained in the EE cert that are considered valid = under validation-reconsidered. The valid subset of the resources = contained in the valid EE cert (i.e., the shrunken resources) would = still cover the resources mentioned in the ROA. So a ROA whose = resources were contained exclusively within the retained resources would = be valid. (I would say that=92s good.) >>=20 >>=20 >> i.e. thats like my example 3 above, so I agree thats good from where = I sit as well. >=20 > Good, then I=92ve got that much of validation-reconsidered right. >=20 Its a good point, however, and I hope its been useful to consider in = this way. regards, Geoff From nobody Wed Dec 2 22:27:04 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ACC671B31C3 for ; Wed, 2 Dec 2015 22:27:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gou7FBjOUCtg for ; Wed, 2 Dec 2015 22:27:00 -0800 (PST) Received: from mail.zdns.cn (smtp.knet.cn [202.173.10.15]) by ietfa.amsl.com (Postfix) with SMTP id 003941B31B6 for ; Wed, 2 Dec 2015 22:26:59 -0800 (PST) X-TM-DID: 1472a9609784046d043f355d55be28a4 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.1 \(3096.5\)) From: Declan Ma In-Reply-To: <29702B8D-B96A-4361-AB45-A1649B0CD3C2@gmail.com> Date: Thu, 3 Dec 2015 14:24:32 +0800 Content-Transfer-Encoding: quoted-printable Message-Id: <1AB63B6D-9EFF-4EC8-8D8B-1720926A58EE@zdns.cn> References: <565617E8.4070005@bbn.com> <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> <565D7EB9.9090902@gmail.com> <81F085EE-8B51-493B-997D-A8D6147105B1@ripe.net> <565DB1C5.8050802@gmail.com> <7C1B79AF-ED56-42AC-9D4F-240F243F779E@tislabs.com> <29702B8D-B96A-4361-AB45-A1649B0CD3C2@gmail.com> To: Geoff Huston X-Mailer: Apple Mail (2.3096.5) Archived-At: Cc: sidr , Sandra Murphy Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Dec 2015 06:27:02 -0000 > =E5=9C=A8 2015=E5=B9=B412=E6=9C=882=E6=97=A5=EF=BC=8C18:23=EF=BC=8CGeoff= Huston =E5=86=99=E9=81=93=EF=BC=9A >=20 >=20 >=20 > Example 2: >=20 > A CA Cert: 1.0.0.0/24, 2.0.0.0/24 >=20 > issues: >=20 > B CA Cert: 1.0.0.0/24, 2.0.0.0/24, 3.0.0.0/24 >=20 > issues: >=20 > C EE Cert: 1.0.0.0/24, 2.0.0.0/24 >=20 > and signs >=20 > ROA: 1.0.0.0/24 AS1 >=20 > still all good (assuming that A is a trust anchor) >=20 > Example 3: >=20 > A CA Cert: 1.0.0.0/24, 2.0.0.0/24 >=20 > issues: >=20 > B CA Cert: 1.0.0.0/24, 2.0.0.0/24, 3.0.0.0/24 >=20 > issues: >=20 > C EE Cert: 1.0.0.0/24, 3.0.0.0/24 >=20 > and signs >=20 > ROA: 1.0.0.0/24 AS1 >=20 > still all good (assuming that A is a trust anchor) Geoff, In section 2.3 of RFC 6480, the very text says: For ROAs and manifests, there will be a one-to-one correspondence between end-entity certificates and signed objects, i.e., the private key corresponding to each end-entity certificate is used to sign exactly one object, and each object is signed with only one key. Due to the so-called one-to-one, why bother to create an EE cert that = has more INR than its corresponding ROA? Sorta confused. Di >=20 > Example 4: >=20 > A CA Cert: 1.0.0.0/24, 2.0.0.0/24 >=20 > issues: >=20 > B CA Cert: 1.0.0.0/24, 2.0.0.0/24, 3.0.0.0/24 >=20 > issues: >=20 > C EE Cert: 1.0.0.0/24, 3.0.0.0/24 >=20 > and signs >=20 > ROA: 1.0.0.0/24, 3.0.0.0/24 AS1 >=20 > invalid ROA >=20 > (or at least that=E2=80=99s my opinion of what should happen. My = assumption here is that the ROA IS intentionally a collection of = resources where the entirety of the collection is important, so if all = elements of the collection cannot be validated via the ROA=E2=80=99s EE = certificate then its a dud ROA.) >=20 >=20 >=20 >>=20 >> Under validation-reconsidered, we would need to make sure this = section said something about the validity of the resources in the valid = EE cert. >=20 >=20 > I don=E2=80=99t think its a question of the EE cert, but the question = of section 4 of RFC6482 and what validation of the ROA means. >=20 >>=20 >> Just in case it is not obvious: >>=20 >> Suppose the EE cert always contained more resources than the ROA = mentioned. >=20 >=20 > which is ok today under RFC6482 >=20 >>=20 >> Suppose the ROA did not mention the resources that were removed. In = that case the shrinking of the parent causes a shrinking of the set of = resources that are contained in the EE cert that are considered valid = under validation-reconsidered. The valid subset of the resources = contained in the valid EE cert (i.e., the shrunken resources) would = still cover the resources mentioned in the ROA. So a ROA whose = resources were contained exclusively within the retained resources would = be valid. (I would say that=E2=80=99s good.) >=20 >=20 > i.e. thats like my example 3 above, so I agree thats good from where I = sit as well. >=20 >>=20 >> =E2=80=94Sandy, speaking as regular ol=E2=80=99 member >>=20 >> (We=E2=80=99ve overloaded =E2=80=9CValid=E2=80=9D a couple of = different ways valid certs, valid ROAs, valid origins, valid = Signature_Blocks, =E2=80=A6) - it might be nice to readers and users to = come up with a different adjective here for the subset of the resources = that are contained within the certificate, rather than yet another use = of =E2=80=9Cvalid=E2=80=9D. Before we have to talk about valid certs = with invalid resources.) >>=20 >=20 >=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From nobody Wed Dec 2 22:33:01 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A2EC1B31C3 for ; Wed, 2 Dec 2015 22:32:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ja2geMuyy_Sp for ; Wed, 2 Dec 2015 22:32:58 -0800 (PST) Received: from mail-pa0-x233.google.com (mail-pa0-x233.google.com [IPv6:2607:f8b0:400e:c03::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 57AC21B31D3 for ; Wed, 2 Dec 2015 22:32:54 -0800 (PST) Received: by pabfh17 with SMTP id fh17so64174991pab.0 for ; Wed, 02 Dec 2015 22:32:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=Y+Xtl1cr+M1847uVLl2MdTopBDBsIVF/iB9fxEjXgqs=; b=HH7kEIw3TpZ3kkBr8+jpzsLFf8VgIfElkptb7uzXuo2xDzmk9KXJ8DiPaeeEU8dZRP 1jnkS1ZhPjzqbczLMXM5FkrVZbLs4bZD+iDuvwm6iG62UAMGOmilIN4EtAFsLRBxGiI7 xfxjiZmqgOIPO3Chipkzr3zeSOqF5QxaPUyxB40hWHwUFCMcl4K6aVkSDz9JbJYokExy zdK7130/0heZIf+y+kButtrAc0pwG9ZErV74TxTWi30BPJ7NFZd5bUJ8sn/K5/aBdr8M kiH1kYg0vgByPHti6ivEJQv4eiyHojrzt7XvqK432t9MRTp5R8LsFWvM8A+4U/3bX4I7 RA5Q== X-Received: by 10.98.73.10 with SMTP id w10mr10745314pfa.164.1449124373922; Wed, 02 Dec 2015 22:32:53 -0800 (PST) Received: from [10.3.20.62] ([119.225.153.211]) by smtp.gmail.com with ESMTPSA id k2sm8147322pfj.25.2015.12.02.22.32.51 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 02 Dec 2015 22:32:53 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.1 \(3096.5\)) From: Geoff Huston In-Reply-To: <1AB63B6D-9EFF-4EC8-8D8B-1720926A58EE@zdns.cn> Date: Thu, 3 Dec 2015 17:32:47 +1100 Content-Transfer-Encoding: quoted-printable Message-Id: <57C5F2E5-4C1D-48FF-8551-1818E65F38DC@gmail.com> References: <565617E8.4070005@bbn.com> <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> <565D7EB9.9090902@gmail.com> <81F085EE-8B51-493B-997D-A8D6147105B1@ripe.net> <565DB1C5.8050802@gmail.com> <7C1B79AF-ED56-42AC-9D4F-240F243F779E@tislabs.com> <29702B8D-B96A-4361-AB45-A1649B0CD3C2@gmail.com> <1AB63B6D-9EFF-4EC8-8D8B-1720926A58EE@zdns.cn> To: Declan Ma X-Mailer: Apple Mail (2.3096.5) Archived-At: Cc: Sandra Murphy , sidr Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Dec 2015 06:32:59 -0000 > On 3 Dec 2015, at 5:24 PM, Declan Ma wrote: >=20 >=20 >=20 >=20 >=20 >> =E5=9C=A8 2015=E5=B9=B412=E6=9C=882=E6=97=A5=EF=BC=8C18:23=EF=BC=8CGeof= f Huston =E5=86=99=E9=81=93=EF=BC=9A >>=20 >>=20 >>=20 >> Example 2: >>=20 >> A CA Cert: 1.0.0.0/24, 2.0.0.0/24 >>=20 >> issues: >>=20 >> B CA Cert: 1.0.0.0/24, 2.0.0.0/24, 3.0.0.0/24 >>=20 >> issues: >>=20 >> C EE Cert: 1.0.0.0/24, 2.0.0.0/24 >>=20 >> and signs >>=20 >> ROA: 1.0.0.0/24 AS1 >>=20 >> still all good (assuming that A is a trust anchor) >>=20 >> Example 3: >>=20 >> A CA Cert: 1.0.0.0/24, 2.0.0.0/24 >>=20 >> issues: >>=20 >> B CA Cert: 1.0.0.0/24, 2.0.0.0/24, 3.0.0.0/24 >>=20 >> issues: >>=20 >> C EE Cert: 1.0.0.0/24, 3.0.0.0/24 >>=20 >> and signs >>=20 >> ROA: 1.0.0.0/24 AS1 >>=20 >> still all good (assuming that A is a trust anchor) >=20 > Geoff, >=20 >=20 > In section 2.3 of RFC 6480, the very text says: >=20 > For ROAs and manifests, there will be a one-to-one correspondence > between end-entity certificates and signed objects, i.e., the = private > key corresponding to each end-entity certificate is used to sign > exactly one object, and each object is signed with only one key. >=20 >=20 > Due to the so-called one-to-one, why bother to create an EE cert that = has more INR than its corresponding ROA? >=20 > Sorta confused. >=20 I have no idea why either - but - the specs don=E2=80=99t say that the = resources listed in the EE cert must exactly match the resources in the ROA, so its possible for the EE cert to have a larger = number resource set than the ROA. regards, Geoff From nobody Wed Dec 2 22:43:53 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55B3D1B3214 for ; Wed, 2 Dec 2015 22:43:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.151 X-Spam-Level: X-Spam-Status: No, score=-0.151 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_CHARSET_FARAWAY=2.45, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CbCMuDHhIYv6 for ; Wed, 2 Dec 2015 22:43:50 -0800 (PST) Received: from mail.zdns.cn (smtp.knet.cn [202.173.10.15]) by ietfa.amsl.com (Postfix) with SMTP id 3D6DE1B3217 for ; Wed, 2 Dec 2015 22:43:14 -0800 (PST) X-TM-DID: d61fa4fae11a4f9d1db2de92c220e0f5 Content-Type: text/plain; charset=gb2312 Mime-Version: 1.0 (Mac OS X Mail 9.1 \(3096.5\)) From: Declan Ma In-Reply-To: <57C5F2E5-4C1D-48FF-8551-1818E65F38DC@gmail.com> Date: Thu, 3 Dec 2015 14:41:00 +0800 Content-Transfer-Encoding: quoted-printable Message-Id: <77F46013-C1EF-488F-A53D-2200D4DD5DC1@zdns.cn> References: <565617E8.4070005@bbn.com> <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> <565D7EB9.9090902@gmail.com> <81F085EE-8B51-493B-997D-A8D6147105B1@ripe.net> <565DB1C5.8050802@gmail.com> <7C1B79AF-ED56-42AC-9D4F-240F243F779E@tislabs.com> <29702B8D-B96A-4361-AB45-A1649B0CD3C2@gmail.com> <1AB63B6D-9EFF-4EC8-8D8B-1720926A58EE@zdns.cn> <57C5F2E5-4C1D-48FF-8551-1818E65F38DC@gmail.com> To: Geoff Huston X-Mailer: Apple Mail (2.3096.5) Archived-At: Cc: Sandra Murphy , sidr Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Dec 2015 06:43:52 -0000 > =D4=DA 2015=C4=EA12=D4=C23=C8=D5=A3=AC14:32=A3=ACGeoff Huston = =D0=B4=B5=C0=A3=BA >=20 >=20 >> On 3 Dec 2015, at 5:24 PM, Declan Ma wrote: >>=20 >>=20 >>> =D4=DA 2015=C4=EA12=D4=C22=C8=D5=A3=AC18:23=A3=ACGeoff Huston = =D0=B4=B5=C0=A3=BA >>>=20 >>>=20 >>>=20 >>> Example 2: >>>=20 >>> A CA Cert: 1.0.0.0/24, 2.0.0.0/24 >>>=20 >>> issues: >>>=20 >>> B CA Cert: 1.0.0.0/24, 2.0.0.0/24, 3.0.0.0/24 >>>=20 >>> issues: >>>=20 >>> C EE Cert: 1.0.0.0/24, 2.0.0.0/24 >>>=20 >>> and signs >>>=20 >>> ROA: 1.0.0.0/24 AS1 >>>=20 >>> still all good (assuming that A is a trust anchor) >>>=20 >>> Example 3: >>>=20 >>> A CA Cert: 1.0.0.0/24, 2.0.0.0/24 >>>=20 >>> issues: >>>=20 >>> B CA Cert: 1.0.0.0/24, 2.0.0.0/24, 3.0.0.0/24 >>>=20 >>> issues: >>>=20 >>> C EE Cert: 1.0.0.0/24, 3.0.0.0/24 >>>=20 >>> and signs >>>=20 >>> ROA: 1.0.0.0/24 AS1 >>>=20 >>> still all good (assuming that A is a trust anchor) >>=20 >> Geoff, >>=20 >>=20 >> In section 2.3 of RFC 6480, the very text says: >>=20 >> For ROAs and manifests, there will be a one-to-one correspondence >> between end-entity certificates and signed objects, i.e., the = private >> key corresponding to each end-entity certificate is used to sign >> exactly one object, and each object is signed with only one key. >>=20 >>=20 >> Due to the so-called one-to-one, why bother to create an EE cert that = has more INR than its corresponding ROA? >>=20 >> Sorta confused. >>=20 >=20 > I have no idea why either - but - the specs don=A1=AFt say that the = resources listed in the EE cert must exactly match the > resources in the ROA, so its possible for the EE cert to have a larger = number resource set than the ROA. >=20 >=20 > regards, >=20 > Geoff >=20 Indeed. I am fine with this. Di, From nobody Thu Dec 3 01:20:45 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 932BF1A01F7 for ; Thu, 3 Dec 2015 01:20:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZLshCeBdvWvx for ; Thu, 3 Dec 2015 01:20:37 -0800 (PST) Received: from mail-wm0-x22f.google.com (mail-wm0-x22f.google.com [IPv6:2a00:1450:400c:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA70D1A0060 for ; Thu, 3 Dec 2015 01:20:36 -0800 (PST) Received: by wmvv187 with SMTP id v187so17119578wmv.1 for ; Thu, 03 Dec 2015 01:20:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-type; bh=kSEv7+Y258o0C0wxf5FEeb8U+W2Vf1eKNFvSEpsZW74=; b=acVBpwbY6Q1RF3ZXMyP/qENFg+DiRnLfvMOLmbJ+umgPUSYMjA9PhZrjyTUbQM2Nc9 WsysjlgtkPZ24d05nvyBr/vOjZQMATWmkIbtYF504eCI2lE9EsDg4O3aeL2e4OQ77lU5 WoJgVq0nj3wPn01EmlDyir+8ebISF02mk2MRicY+GgYhpd8/KgMGlwjBeTTPhKS+kEBk Uvpgfr+20grhuccTb+mtXPBhedXATJbBX2VL8Q7RI1Zj/SHSpDQp8Q14c+uM+N2hKW/B UnDv57+b9NjELpsXvZh25IUrEBMVC2f2rMqrMLU3z6T7xipVs/tksJ/IJodocLNgGcbB yZLg== X-Received: by 10.28.18.138 with SMTP id 132mr11315844wms.6.1449134435378; Thu, 03 Dec 2015 01:20:35 -0800 (PST) Received: from ISOC-A1FD58.local ([92.109.70.118]) by smtp.googlemail.com with ESMTPSA id t2sm1449037wmt.1.2015.12.03.01.20.33 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 03 Dec 2015 01:20:34 -0800 (PST) To: Sandra Murphy , Geoff Huston References: <565617E8.4070005@bbn.com> <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> <565D7EB9.9090902@gmail.com> <81F085EE-8B51-493B-997D-A8D6147105B1@ripe.net> <565DB1C5.8050802@gmail.com> <7C1B79AF-ED56-42AC-9D4F-240F243F779E@tislabs.com> <29702B8D-B96A-4361-AB45-A1649B0CD3C2@gmail.com> From: Andrei Robachevsky X-Enigmail-Draft-Status: N1110 Message-ID: <56600960.3060300@gmail.com> Date: Thu, 3 Dec 2015 10:20:32 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="XDU9Ip9qmCfvaSUpNnwu0sKdoA2CJaD0l" Archived-At: Cc: sidr Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Dec 2015 09:20:38 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --XDU9Ip9qmCfvaSUpNnwu0sKdoA2CJaD0l Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Sandra Murphy wrote on 02/12/15 19:28: > Under validation-reconsidered, I would say that the ROA should be valid= if the IP addresses it contains are contained within the *valid* resourc= es among the resources specified in the EE cert. >=20 > We need to say that because the valid resources specified in a valid EE= cert could be a proper subset of the resources specified in the EE cert.= As your examples show. Just =93contained within=94 is not going to be = sufficient specification. >=20 > No biggie, just a need for more precise text, under validation-reconsid= ered. Agree, the validation reconsidered will require a more precise definition in RFC6482, something like: The IP address delegation extension [RFC3779] is present in the end-entity (EE) certificate (contained within the ROA), and the whole collection of IP address prefix(es) in the ROA is contained within the set of IP addresses specified by the EE certificate's IP address delegation extension that are valid according to the [validation-reconsidered] checks. There might be other places that may read ambiguously in light of validation reconsidered. The thing is that we now have a bunch of validity concepts: a valid certificate, a valid resource within an extension of a valid certificate, a valid ROA (and we do not extent this further to a valid resource within a ROA). Andrei --XDU9Ip9qmCfvaSUpNnwu0sKdoA2CJaD0l Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2 Comment: GPGTools - https://gpgtools.org iEYEARECAAYFAlZgCWEACgkQljz5tZmtij9x/gCgk5Q1zkxsTTJpv6HRcx85TQUG D6EAoMwm6oXzXpkMTZpwpfEbNdBSxMu+ =IjhS -----END PGP SIGNATURE----- --XDU9Ip9qmCfvaSUpNnwu0sKdoA2CJaD0l-- From nobody Fri Dec 4 21:29:36 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB2EF1A0334; Fri, 4 Dec 2015 21:29:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6i-qhV-sehI1; Fri, 4 Dec 2015 21:29:32 -0800 (PST) Received: from walnut.tislabs.com (walnut.tislabs.com [192.94.214.200]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E40C51A0338; Fri, 4 Dec 2015 21:29:31 -0800 (PST) Received: from nova.tislabs.com (unknown [10.66.1.77]) by walnut.tislabs.com (Postfix) with ESMTP id 2321D28B0041; Sat, 5 Dec 2015 00:29:31 -0500 (EST) Received: from [IPv6:::1] (localhost.localdomain [127.0.0.1]) by nova.tislabs.com (Postfix) with ESMTP id A9BB41F801E; Sat, 5 Dec 2015 00:29:30 -0500 (EST) Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Content-Type: multipart/signed; boundary="Apple-Mail=_B524D8EB-448B-4220-BD9A-3801BB67DE2A"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail 2.5.1 From: Sandra Murphy In-Reply-To: Date: Sat, 5 Dec 2015 00:29:29 -0500 Message-Id: <34A163BE-44D1-4994-AEFA-9F09CD0C28AE@tislabs.com> References: <20151118020907.790.34242.idtracker@ietfa.amsl.com> <938892D5-919F-4C61-B518-7145CB40A05B@tislabs.com> To: sidr X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: "draft-ietf-sidr-rfc6485bis@ietf.org" , "sidr-chairs@ietf.org" , Sandra Murphy Subject: Re: [sidr] Terry Manderson's Discuss on draft-ietf-sidr-rfc6485bis-04: (with DISCUSS) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Dec 2015 05:29:34 -0000 --Apple-Mail=_B524D8EB-448B-4220-BD9A-3801BB67DE2A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 The AD, the chairs and the authors have discussed the draft change = suggested below. To summarize: The language Terry=92s DISCUSS objects to is SHOULD = recommendations of how to handle algorithm transitions, and being SHOULD = only, leads to potential differences in implementation and operation = choice. RFC6916 made much more stringent descriptions of algorithm = transition and mandates certain actions. RFC6916 was published a year = after RFC6485 and rfc6485bis attempts to meld the two by pointing to it, = but leaves the SHOULD language in place. The decision of AD, chairs and authors is that the wg consensus for = rfc6485bis was focussed on the OID problem, so it could not be said that = this section was carefully considered by the wg. So the draft draft-ietf-sidr-rfc6485bis-04 is being returned to the wg = to address this problem and then to do a wglc (and IETF Last Call) = before it is returned to the IESG. =97Sandy, speaking as one of the co-chairs On Nov 19, 2015, at 10:59 PM, Terry Manderson = wrote: > Hi Sandy, >=20 >=20 > On 20/11/2015 4:27 am, "Sandra Murphy" wrote: >=20 >> A bit of history here. >>=20 >> After RFC6485 was published, it was discovered that it incorrectly = used >> the same OID for all RPKI crypto uses, which conflicts with CMS specs = and >> is inconsistent with known implementations. >=20 > I am aware of that. >=20 >>=20 >> The wg decided to create RFC6485bis, to correct the OID problem and = the >> OID problem only, with emphasis on the =B3only=B2. >=20 > Timeline leap is not your friend here. 6485 pre-dates 6916. 6485 is > minimalist (and from a point of view, wrong) about algorithm changes. >=20 >>=20 >> The =B3SHOULD=B2 language in section 5 is inherited from RFC6485, = except for: >>=20 >> The recommended >> procedures to implement such a transition of key sizes and = algorithms >> is specified in [RFC6916] >>=20 >> RFC6916, which was published a year after RFC6485, is "Algorithm = Agility >> Procedure for the Resource Public Key Infrastructure (RPKI)=B2. It >> describes the procedure to follow in transitioning from one = algorithm/key >> size to another. >=20 > Correct. It was this text that drew me to the section. And since the = text > pre-dates 6916, which takes a more encompassing view of an > algorithm/profile change with a security section that adequately warns = of > invalidity due to a RP not supporting the new certificate profile, I = view > 6916 as more 'with the times' (YMMV). >=20 >=20 >>=20 >> Does RFC6916 satisfy your concerns about a change of algorithm? >=20 > It does a better job that allowing a CA or RP to opt out and fracture = the > RPKI. >=20 >>=20 >> Would you prefer that RFC6485bis remove the inherited =B3SHOULD=B2 = language >> and point only to RFC6916? >=20 > Yes, That is certainly one way to address this. And I would be OK with > that. >=20 >=20 > Cheers > Terry >=20 >>=20 >> =8BSandy >>=20 >> On Nov 17, 2015, at 9:09 PM, Terry Manderson = >> wrote: >>=20 >>> Terry Manderson has entered the following ballot position for >>> draft-ietf-sidr-rfc6485bis-04: Discuss >>>=20 >>> When responding, please keep the subject line intact and reply to = all >>> email addresses included in the To and CC lines. (Feel free to cut = this >>> introductory paragraph, however.) >>>=20 >>>=20 >>> Please refer to >>> https://www.ietf.org/iesg/statement/discuss-criteria.html >>> for more information about IESG DISCUSS and COMMENT positions. >>>=20 >>>=20 >>> The document, along with other ballot positions, can be found here: >>> https://datatracker.ietf.org/doc/draft-ietf-sidr-rfc6485bis/ >>>=20 >>>=20 >>>=20 >>> = ---------------------------------------------------------------------- >>> DISCUSS: >>> = ---------------------------------------------------------------------- >>>=20 >>> I'm not so sure that this will be an easy DISCUSS to work through as = I >>> view this in light of future sustainability/deployability of RPKI = and >>> any >>> protocol wedded to it (eg BGPSEC). >>>=20 >>> Section 5 "Additional Requirements" suggests that both CAs and RPs >>> "SHOULD" be capable of supporting a transition and thus able to = support >>> multiple RPKI alg. and key profiles. To me this "SHOULD" seems like = it >>> invites fragility in any such transition. An immediate example would = be >>> the root DNSSEC ksk rollover. An rather large amount of work is = underway >>> to ascertain the impact. By leaving the SHOULDs in place is this = walking >>> the same path? >>>=20 >>> Let me ask another way. Under what situations is it actually = appropriate >>> for a CA or RP to be able to ignore the requirement of being able to >>> support a phased introduction/deprecation of new/different RPKI >>> algorithm >>> and key profiles? And if they ignore such a recommendation does this >>> make >>> the entire RPKI infrastructure a fractured PKI by algorithm? >>>=20 >>>=20 >>>=20 >>>=20 >>> _______________________________________________ >>> sidr mailing list >>> sidr@ietf.org >>> https://www.ietf.org/mailman/listinfo/sidr >>=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr --Apple-Mail=_B524D8EB-448B-4220-BD9A-3801BB67DE2A Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWYnY6AAoJEHplpQeet0IZo3AQAJQw275G7CsymguU6xVavUQZ QSCmF6Ni22N3YPUxC65aasR0EMpZs96yG9Pd/QPPv/ZFqtgaiTSbCeiW2eUnIX0e tmp1U0H154iomQTQeEuQhfdvLv4nm/5MEl65gpFGeUf1FQgoI/fGLbJZ9349gzA5 KlKBAmYIlYGCnLOowjd027gjGN1r9S5yW57TitoAraunhyspCVZHQw6ggBMvL+bO zthRRnlFBRKkrLd+X9EeU/TFVLNAOtziiw0jLmaT+UPd4Bd5/qFWVzIdhM+z8Y0V vtrR0h9B/O1PwnQkbQ4rTic6HREdR/sXqLgr2ynb3dHm4JA6Q5lCanSOILnZl0c4 2qfN56ElY96shu8HwEe0bCuhLdcGXFLKPSUdRxbpM1W7yGn7ykRQsDrz8BZQpOXZ W2gYvuj/ynO2t7m0+NAaL9yyGhzg0vIDTUzT/d8UutG6gtg8dvddB4S+COe9jZGm 6ftqyhF3Q5Dy2TlRnd5akwRwAwE4TK0tWU4Ergya9lO4A5kqjVC0ziWOqPvuLHTO S5h52w78KFcIlnMlJjfynU0eUck0EEzEd0ifsK/70bHuhJYUgU0hr7+ZWjgY/uR+ HR5253R4H1oK7ozGwF2NlpksTGW66VoNFzxgzjYbbPg69Q1fORqGlVnrm1TBacvy 2KgCagoMvBRc/tNEW+br =rlai -----END PGP SIGNATURE----- --Apple-Mail=_B524D8EB-448B-4220-BD9A-3801BB67DE2A-- From nobody Sun Dec 6 20:57:14 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F7491B2E1C for ; Sun, 6 Dec 2015 20:57:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.701 X-Spam-Level: X-Spam-Status: No, score=0.701 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n_NTW8RMBS07 for ; Sun, 6 Dec 2015 20:57:01 -0800 (PST) Received: from mail-lf0-x231.google.com (mail-lf0-x231.google.com [IPv6:2a00:1450:4010:c07::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C4241B2E1A for ; Sun, 6 Dec 2015 20:57:00 -0800 (PST) Received: by lfaz4 with SMTP id z4so144829436lfa.0 for ; Sun, 06 Dec 2015 20:56:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=o+lxYFtxScWYsX5vFqOcCjbx3qbny+/dgZY1gFQP3rE=; b=QJavzThOEAs0YIpfprho8tu8uSmkpnL2HTsav6UAnLMAsbVu60VWi5cBepUnALwSa9 bV5zZJuZ5956K8q3UGMlawAWVLt4FeIXdDB6SEHCc42rxgGk3mmqBX63bxPgA9xPUXGN cZYpg+LDO1ED5cJhv+RLi3K5WmkeLuZ8b9zVqPDH/JzUYmpxsL0uu/Xv8b1R5qFGMamB MjVKIPeWTRqNfMSxIRmYgT5EziE1hBIHm7vUr9p1NHFMbJ4qaESRP4qcA7Y0inM9I+v+ EAWS7Ndly7jNOsQicAQjMxcfU3MhZbT0eCFyrInfwjzwtZLUhJ4BaVy/Zq6B2Po0n2fs ezjg== MIME-Version: 1.0 X-Received: by 10.25.15.101 with SMTP id e98mr12803564lfi.49.1449464218288; Sun, 06 Dec 2015 20:56:58 -0800 (PST) Received: by 10.25.158.16 with HTTP; Sun, 6 Dec 2015 20:56:58 -0800 (PST) Date: Sun, 6 Dec 2015 23:56:58 -0500 Message-ID: From: Matthew Lepinski To: "sidr@ietf.org" Content-Type: multipart/mixed; boundary=001a113f8ffad8b0b1052647afcd Archived-At: Subject: [sidr] BGPsec - Security Guarantees : Modified Text X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2015 04:57:13 -0000 --001a113f8ffad8b0b1052647afcd Content-Type: multipart/alternative; boundary=001a113f8ffad8b0ac052647afcb --001a113f8ffad8b0ac052647afcb Content-Type: text/plain; charset=UTF-8 There was a discussion back in October in which the working group supported significant changes to BGPsec-protocol. This was to address an identified mis-match between what was stated (for security properties) and what was actually achieved. To address these concerns, I have made substantial changes to Section 4 (propagating update messages) and smaller changes to Section 5.2 (validation algorithm). The security considerations text likely still needs to be modified, but it would be helpful if someone in the group took a look at the new Section 4 and provided feedback on whether the new text is in line with the conclusions from this thread: http://www.ietf.org/mail-archive/web/sidr/current/msg07291.html Thanks a lot, - Matt Lepinski --001a113f8ffad8b0ac052647afcb Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
There was a discussion back in October in which the workin= g group supported significant changes to BGPsec-protocol. This was to addre= ss an identified mis-match between what was stated (for security properties= ) and what was actually achieved.

To address these concerns, I have= made substantial changes to Section 4 (propagating update messages) and sm= aller changes to Section 5.2 (validation algorithm).

The secu= rity considerations text likely still needs to be modified, but it would be= helpful if someone in the group took a look at the new Section 4 and provi= ded feedback on whether the new text is in line with the conclusions from t= his thread:=C2=A0http://www.ietf.org/mail-archive/web/sidr/current/msg0729= 1.html

Thanks a lot,
- Matt Lepinski=
--001a113f8ffad8b0ac052647afcb-- --001a113f8ffad8b0b1052647afcd Content-Type: text/plain; charset=US-ASCII; name="draft-ietf-sidr-bgpsec-protocol-14.txt" Content-Disposition: attachment; filename="draft-ietf-sidr-bgpsec-protocol-14.txt" Content-Transfer-Encoding: base64 X-Attachment-Id: f_ihvhkexp0 IA0KDQoNCg0KTmV0d29yayBXb3JraW5nIEdyb3VwICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBNLiBMZXBpbnNraSwgRWQuDQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOQ0YNCkludGVuZGVkIHN0YXR1 czogU3RhbmRhcmRzIFRyYWNrICAgICAgICAgICAgICAgICAgICAgICAgRGVjZW1iZXIgNiwgMjAx NQ0KRXhwaXJlczogTWF5IDYsIDIwMTYgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgDQoNCg0KICAgICAgICAgICAgICAgICAgICAgQkdQc2VjIFByb3Rv Y29sIFNwZWNpZmljYXRpb24NCiAgICAgICAgICAgICAgICAgICBkcmFmdC1pZXRmLXNpZHItYmdw c2VjLXByb3RvY29sLTE0DQoNCkFic3RyYWN0DQoNCiAgIFRoaXMgZG9jdW1lbnQgZGVzY3JpYmVz IEJHUHNlYywgYW4gZXh0ZW5zaW9uIHRvIHRoZSBCb3JkZXIgR2F0ZXdheQ0KICAgUHJvdG9jb2wg KEJHUCkgdGhhdCBwcm92aWRlcyBzZWN1cml0eSBmb3IgdGhlIHBhdGggb2YgYXV0b25vbW91cw0K ICAgc3lzdGVtcyB0aHJvdWdoIHdoaWNoIGEgQkdQIHVwZGF0ZSBtZXNzYWdlIHBhc3Nlcy4gIEJH UHNlYyBpcw0KICAgaW1wbGVtZW50ZWQgdmlhIGEgbmV3IG9wdGlvbmFsIG5vbi10cmFuc2l0aXZl IEJHUCBwYXRoIGF0dHJpYnV0ZSB0aGF0DQogICBjYXJyaWVzIGEgZGlnaXRhbCBzaWduYXR1cmUg cHJvZHVjZWQgYnkgZWFjaCBhdXRvbm9tb3VzIHN5c3RlbSB0aGF0DQogICBwcm9wYWdhdGVzIHRo ZSB1cGRhdGUgbWVzc2FnZS4NCg0KUmVxdWlyZW1lbnRzIExhbmd1YWdlDQoNCiAgIFRoZSBrZXkg d29yZHMgIk1VU1QiLCAiTVVTVCBOT1QiLCAiUkVRVUlSRUQiLCAiU0hBTEwiLCAiU0hBTEwgTk9U IiwNCiAgICJTSE9VTEQiLCAiU0hPVUxEIE5PVCIsICJSRUNPTU1FTkRFRCIsICJOT1QgUkVDT01N RU5ERUQiLCAiTUFZIiwgYW5kDQogICAiT1BUSU9OQUwiIGFyZSB0byBiZSBpbnRlcnByZXRlZCBh cyBkZXNjcmliZWQgaW4gUkZDIDIxMTkgWzFdIG9ubHkNCiAgIHdoZW4gdGhleSBhcHBlYXIgaW4g YWxsIHVwcGVyIGNhc2UuICBUaGV5IG1heSBhbHNvIGFwcGVhciBpbiBsb3dlciBvcg0KICAgbWl4 ZWQgY2FzZSBhcyBFbmdsaXNoIHdvcmRzLCB3aXRob3V0IG5vcm1hdGl2ZSBtZWFuaW5nLg0KDQpT dGF0dXMgb2YgdGhpcyBNZW1vDQoNCiAgIFRoaXMgSW50ZXJuZXQtRHJhZnQgaXMgc3VibWl0dGVk IGluIGZ1bGwgY29uZm9ybWFuY2Ugd2l0aCB0aGUNCiAgIHByb3Zpc2lvbnMgb2YgQkNQIDc4IGFu ZCBCQ1AgNzkuDQoNCiAgIEludGVybmV0LURyYWZ0cyBhcmUgd29ya2luZyBkb2N1bWVudHMgb2Yg dGhlIEludGVybmV0IEVuZ2luZWVyaW5nDQogICBUYXNrIEZvcmNlIChJRVRGKS4gIE5vdGUgdGhh dCBvdGhlciBncm91cHMgbWF5IGFsc28gZGlzdHJpYnV0ZQ0KICAgd29ya2luZyBkb2N1bWVudHMg YXMgSW50ZXJuZXQtRHJhZnRzLiAgVGhlIGxpc3Qgb2YgY3VycmVudCBJbnRlcm5ldC0NCiAgIERy YWZ0cyBpcyBhdCBodHRwOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZHJhZnRzL2N1cnJlbnQvLg0K DQogICBJbnRlcm5ldC1EcmFmdHMgYXJlIGRyYWZ0IGRvY3VtZW50cyB2YWxpZCBmb3IgYSBtYXhp bXVtIG9mIHNpeCBtb250aHMNCiAgIGFuZCBtYXkgYmUgdXBkYXRlZCwgcmVwbGFjZWQsIG9yIG9i c29sZXRlZCBieSBvdGhlciBkb2N1bWVudHMgYXQgYW55DQogICB0aW1lLiAgSXQgaXMgaW5hcHBy b3ByaWF0ZSB0byB1c2UgSW50ZXJuZXQtRHJhZnRzIGFzIHJlZmVyZW5jZQ0KICAgbWF0ZXJpYWwg b3IgdG8gY2l0ZSB0aGVtIG90aGVyIHRoYW4gYXMgIndvcmsgaW4gcHJvZ3Jlc3MuIg0KDQogICBU aGlzIEludGVybmV0LURyYWZ0IHdpbGwgZXhwaXJlIG9uIE1heSA2LCAyMDE2Lg0KDQpDb3B5cmln aHQgTm90aWNlDQoNCiAgIENvcHlyaWdodCAoYykgMjAxNSBJRVRGIFRydXN0IGFuZCB0aGUgcGVy c29ucyBpZGVudGlmaWVkIGFzIHRoZQ0KICAgZG9jdW1lbnQgYXV0aG9ycy4gIEFsbCByaWdodHMg cmVzZXJ2ZWQuDQoNCiANCg0KDQpMZXBpbnNraSAgICAgICAgICAgICAgICAgIEV4cGlyZXMgTWF5 IDYsIDIwMTYgICAgICAgICAgICAgICAgICAgW1BhZ2UgMV0NCgwNCkludGVybmV0LURyYWZ0ICAg ICAgICAgICAgICBCR1BzZWMgUHJvdG9jb2wgICAgICAgICAgICAgRGVjZW1iZXIgNiwgMjAxNQ0K DQoNCiAgIFRoaXMgZG9jdW1lbnQgaXMgc3ViamVjdCB0byBCQ1AgNzggYW5kIHRoZSBJRVRGIFRy dXN0J3MgTGVnYWwNCiAgIFByb3Zpc2lvbnMgUmVsYXRpbmcgdG8gSUVURiBEb2N1bWVudHMNCiAg IChodHRwOi8vdHJ1c3RlZS5pZXRmLm9yZy9saWNlbnNlLWluZm8pIGluIGVmZmVjdCBvbiB0aGUg ZGF0ZSBvZg0KICAgcHVibGljYXRpb24gb2YgdGhpcyBkb2N1bWVudC4gIFBsZWFzZSByZXZpZXcg dGhlc2UgZG9jdW1lbnRzDQogICBjYXJlZnVsbHksIGFzIHRoZXkgZGVzY3JpYmUgeW91ciByaWdo dHMgYW5kIHJlc3RyaWN0aW9ucyB3aXRoIHJlc3BlY3QNCiAgIHRvIHRoaXMgZG9jdW1lbnQuICBD b2RlIENvbXBvbmVudHMgZXh0cmFjdGVkIGZyb20gdGhpcyBkb2N1bWVudCBtdXN0DQogICBpbmNs dWRlIFNpbXBsaWZpZWQgQlNEIExpY2Vuc2UgdGV4dCBhcyBkZXNjcmliZWQgaW4gU2VjdGlvbiA0 LmUgb2YNCiAgIHRoZSBUcnVzdCBMZWdhbCBQcm92aXNpb25zIGFuZCBhcmUgcHJvdmlkZWQgd2l0 aG91dCB3YXJyYW50eSBhcw0KICAgZGVzY3JpYmVkIGluIHRoZSBTaW1wbGlmaWVkIEJTRCBMaWNl bnNlLg0KDQoNClRhYmxlIG9mIENvbnRlbnRzDQoNCiAgIDEuICBJbnRyb2R1Y3Rpb24gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMg0KICAgMi4gIEJH UHNlYyBOZWdvdGlhdGlvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuICAzDQogICAgIDIuMS4gIFRoZSBCR1BzZWMgQ2FwYWJpbGl0eSAgLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gIDMNCiAgICAgMi4yLiAgTmVnb3RpYXRpbmcgQkdQc2VjIFN1 cHBvcnQgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgNA0KICAgMy4gIFRoZSBCR1Bz ZWNfUGF0aCBBdHRyaWJ1dGUgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA2 DQogICAgIDMuMS4gIFNlY3VyZV9QYXRoICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gIDcNCiAgICAgMy4yLiAgU2lnbmF0dXJlX0Jsb2NrICAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgOA0KICAgNC4gIEJHUHNlYyBVcGRhdGUg TWVzc2FnZXMgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDEwDQogICAg IDQuMS4gIEdlbmVyYWwgR3VpZGFuY2UgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gMTANCiAgICAgNC4yLiAgQ29uc3RydWN0aW5nIHRoZSBCR1BzZWNfUGF0aCBBdHRy aWJ1dGUgLiAuIC4gLiAuIC4gLiAuIC4gLiAxMg0KICAgICA0LjMuICBQcm9jZXNzaW5nIEluc3Ry dWN0aW9ucyBmb3IgQ29uZmVkZXJhdGlvbiBNZW1iZXJzICAuIC4gLiAuIDE1DQogICAgIDQuNC4g IFJlY29uc3RydWN0aW5nIHRoZSBBU19QQVRIIEF0dHJpYnV0ZSAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gMTgNCiAgIDUuICBQcm9jZXNzaW5nIGEgUmVjZWl2ZWQgQkdQc2VjIFVwZGF0ZSAgLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAxOQ0KICAgICA1LjEuICBPdmVydmlldyBvZiBCR1BzZWMgVmFs aWRhdGlvbiAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDIwDQogICAgIDUuMi4gIFZhbGlk YXRpb24gQWxnb3JpdGhtIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMjIN CiAgIDYuICBBbGdvcml0aG1zIGFuZCBFeHRlbnNpYmlsaXR5IC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAyNQ0KICAgICA2LjEuICBBbGdvcml0aG0gU3VpdGUgQ29uc2lkZXJhdGlv bnMgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDI1DQogICAgIDYuMi4gIEV4dGVuc2liaWxp dHkgQ29uc2lkZXJhdGlvbnMgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMjUNCiAgIDcu ICBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAyNg0KICAgICA3LjEgU2VjdXJpdHkgR3VhcmFudGVlcyAgLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDI2DQogICAgIDcuMiBPbiB0aGUgUmVtb3ZhbCBvZiBC R1BzZWMgU2lnbmF0dXJlcyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMjcNCiAgICAgNy4zIE1p dGlnYXRpb24gb2YgRGVuaWFsIG9mIFNlcnZpY2UgQXR0YWNrcyAgLiAuIC4gLiAuIC4gLiAuIC4g LiAyOQ0KICAgICA3LjQgQWRkaXRpb25hbCBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIDI5DQogICA4LiAgSUFOQSBDb25zaWRlcmF0aW9ucyAgLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMzANCiAgIDkuICBDb250cmlidXRv cnMgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAzMA0K ICAgICA5LjEuICBBdXRob3JzICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIDMwDQogICAgIDkuMi4gIEFja25vd2xlZGdlbWVudHMgLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMzENCiAgIDEwLiAgTm9ybWF0aXZlIFJlZmVy ZW5jZXMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAzMQ0KICAgMTEu ICBJbmZvcm1hdGl2ZSBSZWZlcmVuY2VzICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIDMyDQogICBBdXRob3IncyBBZGRyZXNzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMzQNCg0KDQoNCjEuICBJbnRyb2R1Y3Rpb24NCg0KIA0K DQoNCkxlcGluc2tpICAgICAgICAgICAgICAgICAgRXhwaXJlcyBNYXkgNiwgMjAxNiAgICAgICAg ICAgICAgICAgICBbUGFnZSAyXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgIEJHUHNl YyBQcm90b2NvbCAgICAgICAgICAgICBEZWNlbWJlciA2LCAyMDE1DQoNCg0KICAgVGhpcyBkb2N1 bWVudCBkZXNjcmliZXMgQkdQc2VjLCBhIG1lY2hhbmlzbSBmb3IgcHJvdmlkaW5nIHBhdGgNCiAg IHNlY3VyaXR5IGZvciBCb3JkZXIgR2F0ZXdheSBQcm90b2NvbCAoQkdQKSBbMl0gcm91dGUgYWR2 ZXJ0aXNlbWVudHMuDQogICBUaGF0IGlzLCBhIEJHUCBzcGVha2VyIHdobyByZWNlaXZlcyBhIHZh bGlkIEJHUHNlYyB1cGRhdGUgaGFzDQogICBjcnlwdG9ncmFwaGljIGFzc3VyYW5jZSB0aGF0IHRo ZSBhZHZlcnRpc2VkIHJvdXRlIGhhcyB0aGUgZm9sbG93aW5nDQogICBwcm9wZXJ0eTogRXZlcnkg QVMgb24gdGhlIHBhdGggb2YgQVNlcyBsaXN0ZWQgaW4gdGhlIHVwZGF0ZSBtZXNzYWdlDQogICBo YXMgZXhwbGljaXRseSBhdXRob3JpemVkIHRoZSBhZHZlcnRpc2VtZW50IG9mIHRoZSByb3V0ZSB0 byB0aGUNCiAgIHN1YnNlcXVlbnQgQVMgaW4gdGhlIHBhdGguDQoNCiAgIFRoaXMgZG9jdW1lbnQg c3BlY2lmaWVzIGEgbmV3IG9wdGlvbmFsIChub24tdHJhbnNpdGl2ZSkgQkdQIHBhdGgNCiAgIGF0 dHJpYnV0ZSwgQkdQc2VjX1BhdGguICBJdCBhbHNvIGRlc2NyaWJlcyBob3cgYSBCR1BzZWMtY29t cGxpYW50IEJHUA0KICAgc3BlYWtlciAocmVmZXJyZWQgdG8gaGVyZWFmdGVyIGFzIGEgQkdQc2Vj IHNwZWFrZXIpIGNhbiBnZW5lcmF0ZSwNCiAgIHByb3BhZ2F0ZSwgYW5kIHZhbGlkYXRlIEJHUCB1 cGRhdGUgbWVzc2FnZXMgY29udGFpbmluZyB0aGlzIGF0dHJpYnV0ZQ0KICAgdG8gb2J0YWluIHRo ZSBhYm92ZSBhc3N1cmFuY2VzLg0KDQogICBCR1BzZWMgaXMgaW50ZW5kZWQgdG8gYmUgdXNlZCB0 byBzdXBwbGVtZW50IEJHUCBPcmlnaW4gVmFsaWRhdGlvbg0KICAgWzE5XSBhbmQgd2hlbiB1c2Vk IGluIGNvbmp1bmN0aW9uIHdpdGggb3JpZ2luIHZhbGlkYXRpb24sIGl0IGlzDQogICBwb3NzaWJs ZSB0byBwcmV2ZW50IGEgd2lkZSB2YXJpZXR5IG9mIHJvdXRlIGhpamFja2luZyBhdHRhY2tzIGFn YWluc3QNCiAgIEJHUC4NCg0KICAgQkdQc2VjIHJlbGllcyBvbiB0aGUgUmVzb3VyY2UgUHVibGlj IEtleSBJbmZyYXN0cnVjdHVyZSAoUlBLSSkNCiAgIGNlcnRpZmljYXRlcyB0aGF0IGF0dGVzdCB0 byB0aGUgYWxsb2NhdGlvbiBvZiBBUyBudW1iZXIgYW5kIElQDQogICBhZGRyZXNzIHJlc291cmNl cy4gIChGb3IgbW9yZSBpbmZvcm1hdGlvbiBvbiB0aGUgUlBLSSwgc2VlIFsxMl0gYW5kDQogICB0 aGUgZG9jdW1lbnRzIHJlZmVyZW5jZWQgdGhlcmVpbi4pICBBbnkgQkdQc2VjIHNwZWFrZXIgd2hv IHdpc2hlcyB0bw0KICAgc2VuZCwgdG8gZXh0ZXJuYWwgKGVCR1ApIHBlZXJzLCBCR1AgdXBkYXRl IG1lc3NhZ2VzIGNvbnRhaW5pbmcgdGhlDQogICBCR1BzZWNfUGF0aCBuZWVkcyB0byBwb3NzZXNz IGEgcHJpdmF0ZSBrZXkgYXNzb2NpYXRlZCB3aXRoIGFuIFJQS0kNCiAgIHJvdXRlciBjZXJ0aWZp Y2F0ZSBbOV0gdGhhdCBjb3JyZXNwb25kcyB0byB0aGUgQkdQc2VjIHNwZWFrZXIncyBBUw0KICAg bnVtYmVyLiAgTm90ZSwgaG93ZXZlciwgdGhhdCBhIEJHUHNlYyBzcGVha2VyIGRvZXMgbm90IG5l ZWQgc3VjaCBhDQogICBjZXJ0aWZpY2F0ZSBpbiBvcmRlciB0byB2YWxpZGF0ZSByZWNlaXZlZCB1 cGRhdGUgbWVzc2FnZXMgY29udGFpbmluZw0KICAgdGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZS4N Cg0KMi4gIEJHUHNlYyBOZWdvdGlhdGlvbg0KDQogICBUaGlzIGRvY3VtZW50IGRlZmluZXMgYSBu ZXcgQkdQIGNhcGFiaWxpdHkgWzZdIHRoYXQgYWxsb3dzIGEgQkdQDQogICBzcGVha2VyIHRvIGFk dmVydGlzZSB0byBhIG5laWdoYm9yIHRoZSBhYmlsaXR5IHRvIHNlbmQgb3IgdG8gcmVjZWl2ZQ0K ICAgQkdQc2VjIHVwZGF0ZSBtZXNzYWdlcyAoaS5lLiwgdXBkYXRlIG1lc3NhZ2VzIGNvbnRhaW5p bmcgdGhlDQogICBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUpLg0KDQoyLjEuICBUaGUgQkdQc2VjIENh cGFiaWxpdHkNCg0KICAgVGhpcyBjYXBhYmlsaXR5IGhhcyBjYXBhYmlsaXR5IGNvZGUgOiBUQkQN Cg0KICAgVGhlIGNhcGFiaWxpdHkgbGVuZ3RoIGZvciB0aGlzIGNhcGFiaWxpdHkgTVVTVCBiZSBz ZXQgdG8gMy4NCg0KICAgVGhlIHRocmVlIG9jdGV0cyBvZiB0aGUgY2FwYWJpbGl0eSB2YWx1ZSBh cmUgc3BlY2lmaWVkIGFzIGZvbGxvd3MuDQoNCg0KICAgICAgICAgICAgICAgICAgICAgICBCR1Bz ZWMgU2VuZCBDYXBhYmlsaXR5IFZhbHVlOg0KDQogDQoNCg0KTGVwaW5za2kgICAgICAgICAgICAg ICAgICBFeHBpcmVzIE1heSA2LCAyMDE2ICAgICAgICAgICAgICAgICAgIFtQYWdlIDNdDQoMDQpJ bnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgQkdQc2VjIFByb3RvY29sICAgICAgICAgICAgIERl Y2VtYmVyIDYsIDIwMTUNCg0KDQogICAgICAgICAgICAgICAgICAgIDAgICAxICAgMiAgIDMgICAg ICA0ICAgICAgNSAgIDYgICA3DQogICAgICAgICAgICAgICAgICstLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0rDQogICAgICAgICAgICAgICAgIHwgVmVyc2lvbiAgICAgICAg ICB8IERpciB8ICAgUmVzZXJ2ZWQgICB8DQogICAgICAgICAgICAgICAgICstLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rDQogICAgICAgICAgICAgICAgIHwgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8DQogICAgICAgICAgICAgICAgICstLS0tLS0g ICAgICAgICAgIEFGSSAgICAgICAgICAgICAgLS0tLS0rDQogICAgICAgICAgICAgICAgIHwgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8DQogICAgICAgICAgICAgICAgICst LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rDQoNCiAgIFRoZSBmaXJzdCBm b3VyIGJpdHMgb2YgdGhlIGZpcnN0IG9jdGV0IGluZGljYXRlIHRoZSB2ZXJzaW9uIG9mIEJHUHNl Yw0KICAgZm9yIHdoaWNoIHRoZSBCR1Agc3BlYWtlciBpcyBhZHZlcnRpc2luZyBzdXBwb3J0LiAg VGhpcyBkb2N1bWVudA0KICAgZGVmaW5lcyBvbmx5IEJHUHNlYyB2ZXJzaW9uIDAgKGFsbCBmb3Vy IGJpdHMgc2V0IHRvIHplcm8pLiAgT3RoZXINCiAgIHZlcnNpb25zIG9mIEJHUHNlYyBtYXkgYmUg ZGVmaW5lZCBpbiBmdXR1cmUgZG9jdW1lbnRzLiAgQSBCR1BzZWMNCiAgIHNwZWFrZXIgTUFZIGFk dmVydGlzZSBzdXBwb3J0IGZvciBtdWx0aXBsZSB2ZXJzaW9ucyBvZiBCR1BzZWMgYnkNCiAgIGlu Y2x1ZGluZyBtdWx0aXBsZSB2ZXJzaW9ucyBvZiB0aGUgQkdQc2VjIGNhcGFiaWxpdHkgaW4gaXRz IEJHUCBPUEVODQogICBtZXNzYWdlLg0KDQogICBUaGUgZmlmdGggYml0IG9mIHRoZSBmaXJzdCBv Y3RldCBpcyBhIGRpcmVjdGlvbiBiaXQgd2hpY2ggaW5kaWNhdGVzDQogICB3aGV0aGVyIHRoZSBC R1Agc3BlYWtlciBpcyBhZHZlcnRpc2luZyB0aGUgY2FwYWJpbGl0eSB0byBzZW5kIEJHUHNlYw0K ICAgdXBkYXRlIG1lc3NhZ2VzIG9yIHJlY2VpdmUgQkdQc2VjIHVwZGF0ZSBtZXNzYWdlcy4gVGhl IEJHUCBzcGVha2VyDQogICBzZXRzIHRoaXMgYml0IHRvIDAgdG8gaW5kaWNhdGUgdGhlIGNhcGFi aWxpdHkgdG8gcmVjZWl2ZSBCR1BzZWMNCiAgIHVwZGF0ZSBtZXNzYWdlcy4gVGhlIEJHUCBzcGVh a2VyIHNldHMgdGhpcyBiaXQgdG8gMSB0byBpbmRpY2F0ZSB0aGUNCiAgIGNhcGFiaWxpdHkgdG8g c2VuZCBCR1BzZWMgdXBkYXRlIG1lc3NhZ2VzLg0KDQogICBUaGUgcmVtYWluaW5nIHRocmVlIGJp dHMgb2YgdGhlIGZpcnN0IG9jdGV0IGFyZSByZXNlcnZlZCBmb3IgZnV0dXJlDQogICB1c2UuICBU aGVzZSBiaXRzIGFyZSBzZXQgdG8gemVybyBieSB0aGUgc2VuZGVyIG9mIHRoZSBjYXBhYmlsaXR5 IGFuZA0KICAgaWdub3JlZCBieSB0aGUgcmVjZWl2ZXIgb2YgdGhlIGNhcGFiaWxpdHkuDQoNCiAg IFRoZSBzZWNvbmQgYW5kIHRoaXJkIG9jdGV0cyBjb250YWluIHRoZSAxNi1iaXQgQWRkcmVzcyBG YW1pbHkNCiAgIElkZW50aWZpZXIgKEFGSSkgd2hpY2ggaW5kaWNhdGVzIHRoZSBhZGRyZXNzIGZh bWlseSBmb3Igd2hpY2ggdGhlDQogICBCR1BzZWMgc3BlYWtlciBpcyBhZHZlcnRpc2luZyBzdXBw b3J0IGZvciBCR1BzZWMuICBUaGlzIGRvY3VtZW50IG9ubHkNCiAgIHNwZWNpZmllcyBCR1BzZWMg Zm9yIHVzZSB3aXRoIHR3byBhZGRyZXNzIGZhbWlsaWVzLCBJUHY0IGFuZCBJUHY2LA0KICAgQUZJ IHZhbHVlcyAxIGFuZCAyIHJlc3BlY3RpdmVseS4gIEJHUHNlYyBmb3IgdXNlIHdpdGggb3RoZXIg YWRkcmVzcw0KICAgZmFtaWxpZXMgbWF5IGJlIHNwZWNpZmllZCBpbiBmdXR1cmUgZG9jdW1lbnRz Lg0KDQoyLjIuICBOZWdvdGlhdGluZyBCR1BzZWMgU3VwcG9ydA0KDQogICBJbiBvcmRlciB0byBp bmRpY2F0ZSB0aGF0IGEgQkdQIHNwZWFrZXIgaXMgd2lsbGluZyB0byBzZW5kIEJHUHNlYw0KICAg dXBkYXRlIG1lc3NhZ2VzIChmb3IgYSBwYXJ0aWN1bGFyIGFkZHJlc3MgZmFtaWx5KSwgYSBCR1Ag c3BlYWtlcg0KICAgc2VuZHMgdGhlIEJHUHNlYyBDYXBhYmlsaXR5IChzZWUgU2VjdGlvbiAyLjEp IHdpdGggdGhlIERpcmVjdGlvbiBiaXQNCiAgICh0aGUgZmlmdGggYml0IG9mIHRoZSBmaXJzdCBv Y3RldCkgc2V0IHRvIDEuIEluIG9yZGVyIHRvIGluZGljYXRlDQogICB0aGF0IHRoZSBzcGVha2Vy IGlzIHdpbGxpbmcgdG8gcmVjZWl2ZSBCR1AgdXBkYXRlIG1lc3NhZ2VzIGNvbnRhaW5pbmcNCiAg IHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUgKGZvciBhIHBhcnRpY3VsYXIgYWRkcmVzcyBmYW1p bHkpLCBhIEJHUA0KICAgc3BlYWtlciBzZW5kcyB0aGUgQkdQc2VjIGNhcGFiaWxpdHkgd2l0aCB0 aGUgRGlyZWN0aW9uIGJpdCBzZXQgdG8gMC4NCiAgIEluIG9yZGVyIHRvIGFkdmVydGlzZSB0aGUg Y2FwYWJpbGl0eSB0byBib3RoIHNlbmQgYW5kIHJlY2VpdmUgQkdQc2VjDQogICB1cGRhdGUgbWVz c2FnZXMsIHRoZSBCR1Agc3BlYWtlciBzZW5kcyB0d28gY29waWVzIG9mIHRoZSBCR1BzZWMNCiAg IGNhcGFiaWxpdHkgKG9uZSB3aXRoIHRoZSBkaXJlY3Rpb24gYml0IHNldCB0byAwIGFuZCBvbmUg d2l0aCB0aGUNCiAgIGRpcmVjdGlvbiBiaXQgc2V0IHRvIDEpLg0KIA0KDQoNCkxlcGluc2tpICAg ICAgICAgICAgICAgICAgRXhwaXJlcyBNYXkgNiwgMjAxNiAgICAgICAgICAgICAgICAgICBbUGFn ZSA0XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgIEJHUHNlYyBQcm90b2NvbCAgICAg ICAgICAgICBEZWNlbWJlciA2LCAyMDE1DQoNCg0KICAgU2ltaWxhcmx5LCBpZiBhIEJHUCBzcGVh a2VyIHdpc2hlcyB0byB1c2UgQkdQc2VjIHdpdGggdHdvIGRpZmZlcmVudA0KICAgYWRkcmVzcyBm YW1pbGllcyAoaS5lLiwgSVB2NCBhbmQgSVB2Nikgb3ZlciB0aGUgc2FtZSBCR1Agc2Vzc2lvbiwN CiAgIHRoZW4gdGhlIHNwZWFrZXIgaW5jbHVkZXMgdHdvIGluc3RhbmNlcyBvZiB0aGlzIGNhcGFi aWxpdHkgKG9uZSBmb3INCiAgIGVhY2ggYWRkcmVzcyBmYW1pbHkpIGluIHRoZSBCR1AgT1BFTiBt ZXNzYWdlLiAgQSBCR1Agc3BlYWtlciBNVVNUDQogICBzdXBwb3J0IHRoZSBCR1AgbXVsdGlwcm90 b2NvbCBleHRlbnNpb24gWzNdLiBBZGRpdGlvbmFsbHksIGEgQkdQDQogICBzcGVha2VyIE1VU1Qg Tk9UIGFkdmVydGlzZSB0aGUgY2FwYWJpbGl0eSBvZiBCR1BzZWMgc3VwcG9ydCBmb3IgYQ0KICAg cGFydGljdWxhciBBRkkgdW5sZXNzIGl0IGhhcyBhbHNvIGFkdmVydGlzZWQgdGhlIG11bHRpcHJv dG9jb2wNCiAgIGV4dGVuc2lvbiBjYXBhYmlsaXR5IGZvciB0aGUgc2FtZSBBRkkgY29tYmluYXRp b24gWzNdLg0KDQogICBJbiBhIHNlc3Npb24gd2hlcmUgQkdQIHNlc3Npb24sIGEgcGVlciBpcyBw ZXJtaXR0ZWQgdG8gc2VuZCB1cGRhdGUNCiAgIG1lc3NhZ2VzIGNvbnRhaW5pbmcgdGhlIEJHUHNl Y19QYXRoIGF0dHJpYnV0ZSBpZiwgYW5kIG9ubHkgaWY6DQoNCiAgIG8gIFRoZSBnaXZlbiBwZWVy IHNlbnQgdGhlIEJHUHNlYyBjYXBhYmlsaXR5IGZvciBhIHBhcnRpY3VsYXIgdmVyc2lvbg0KICAg ICAgb2YgQkdQc2VjIGFuZCBhIHBhcnRpY3VsYXIgYWRkcmVzcyBmYW1pbHkgd2l0aCB0aGUgRGly ZWN0aW9uIGJpdA0KICAgICAgc2V0IHRvIDE7IGFuZA0KDQogICBvICBUaGUgb3RoZXIgcGVlciBz ZW50IHRoZSBCR1BzZWMgY2FwYWJpbGl0eSBmb3IgdGhlIHNhbWUgdmVyc2lvbiBvZg0KICAgICAg QkdQc2VjIGFuZCB0aGUgc2FtZSBhZGRyZXNzIGZhbWlseSB3aXRoIHRoZSBEaXJlY3Rpb24gYml0 IHNldCB0bw0KICAgICAgMC4NCg0KICAgSW4gc3VjaCBhIHNlc3Npb24sIHdlIHNheSB0aGF0IHRo ZSB1c2Ugb2YgKHRoZSBwYXJ0aWN1bGFyIHZlcnNpb24gb2YpDQogICBCR1BzZWMgaGFzIGJlZW4g bmVnb3RpYXRlZCAoZm9yIGEgcGFydGljdWxhciBhZGRyZXNzIGZhbWlseSkuICBCR1ANCiAgIHVw ZGF0ZSBtZXNzYWdlcyB3aXRob3V0IHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUgTUFZIGJlIHNl bnQgd2l0aGluDQogICBhIHNlc3Npb24gcmVnYXJkbGVzcyBvZiB3aGV0aGVyIG9yIG5vdCB0aGUg dXNlIG9mIEJHUHNlYyBpcw0KICAgc3VjY2Vzc2Z1bGx5IG5lZ290aWF0ZWQuICBIb3dldmVyLCBp ZiBCR1BzZWMgaXMgbm90IHN1Y2Nlc3NmdWxseQ0KICAgbmVnb3RpYXRlZCwgdGhlbiBCR1AgdXBk YXRlIG1lc3NhZ2VzIGNvbnRhaW5pbmcgdGhlIEJHUHNlY19QYXRoDQogICBhdHRyaWJ1dGUgTVVT VCBOT1QgYmUgc2VudC4NCg0KICAgVGhpcyBkb2N1bWVudCBkZWZpbmVzIHRoZSBiZWhhdmlvciBv ZiBpbXBsZW1lbnRhdGlvbnMgaW4gdGhlIGNhc2UNCiAgIHdoZXJlIEJHUHNlYyB2ZXJzaW9uIHpl cm8gaXMgdGhlIG9ubHkgdmVyc2lvbiB0aGF0IGhhcyBiZWVuDQogICBzdWNjZXNzZnVsbHkgbmVn b3RpYXRlZC4gIEFueSBmdXR1cmUgZG9jdW1lbnQgd2hpY2ggc3BlY2lmaWVzDQogICBhZGRpdGlv bmFsIHZlcnNpb25zIG9mIEJHUHNlYyB3aWxsIG5lZWQgdG8gc3BlY2lmeSBiZWhhdmlvciBpbiB0 aGUNCiAgIGNhc2UgdGhhdCBzdXBwb3J0IGZvciBtdWx0aXBsZSB2ZXJzaW9ucyBpcyBuZWdvdGlh dGVkLg0KDQogICBCR1BzZWMgY2Fubm90IHByb3ZpZGUgbWVhbmluZ2Z1bCBzZWN1cml0eSBndWFy YW50ZWVzIHdpdGhvdXQgc3VwcG9ydA0KICAgZm9yIGZvdXItYnl0ZSBBUyBudW1iZXJzLiAgVGhl cmVmb3JlLCBhbnkgQkdQIHNwZWFrZXIgdGhhdCBhbm5vdW5jZXMNCiAgIHRoZSBCR1BzZWMgY2Fw YWJpbGl0eSwgTVVTVCBhbHNvIGFubm91bmNlIHRoZSBjYXBhYmlsaXR5IGZvciBmb3VyLQ0KICAg Ynl0ZSBBUyBzdXBwb3J0IFs0XS4gSWYgYSBCR1Agc3BlYWtlciBzZW5kcyB0aGUgQkdQc2VjIGNh cGFiaWxpdHkgYnV0DQogICBub3QgdGhlIGZvdXItYnl0ZSBBUyBzdXBwb3J0IGNhcGFiaWxpdHkg dGhlbiBCR1BzZWMgaGFzIG5vdCBiZWVuDQogICBzdWNjZXNzZnVsbHkgbmVnb3RpYXRlZCwgYW5k IHVwZGF0ZSBtZXNzYWdlcyBjb250YWluaW5nIHRoZQ0KICAgQkdQc2VjX1BhdGggYXR0cmlidXRl IE1VU1QgTk9UIGJlIHNlbnQgd2l0aGluIHN1Y2ggYSBzZXNzaW9uLg0KDQogICBOb3RlIHRoYXQg QkdQc2VjIHVwZGF0ZSBtZXNzYWdlcyBjYW4gYmUgcXVpdGUgbGFyZ2UsIHRoZXJlZm9yZSBhbnkN CiAgIEJHUHNlYyBzcGVha2VyIGFubm91bmNpbmcgdGhlIGNhcGFiaWxpdHkgdG8gcmVjZWl2ZSBC R1BzZWMgbWVzc2FnZXMNCiAgIFNIT1VMRCBhbHNvIGFubm91bmNlIHN1cHBvcnQgZm9yIHRoZSBj YXBhYmlsaXR5IHRvIHJlY2VpdmUgQkdQDQogICBleHRlbmRlZCBtZXNzYWdlcyBbOF0uDQoNCg0K IA0KDQoNCkxlcGluc2tpICAgICAgICAgICAgICAgICAgRXhwaXJlcyBNYXkgNiwgMjAxNiAgICAg ICAgICAgICAgICAgICBbUGFnZSA1XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgIEJH UHNlYyBQcm90b2NvbCAgICAgICAgICAgICBEZWNlbWJlciA2LCAyMDE1DQoNCg0KMy4gIFRoZSBC R1BzZWNfUGF0aCBBdHRyaWJ1dGUNCg0KICAgVGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZSBpcyBh IG5ldyBvcHRpb25hbCBub24tdHJhbnNpdGl2ZSBCR1AgcGF0aA0KICAgYXR0cmlidXRlLg0KDQog ICBUaGlzIGRvY3VtZW50IHJlZ2lzdGVycyBhIG5ldyBhdHRyaWJ1dGUgdHlwZSBjb2RlIGZvciB0 aGlzIGF0dHJpYnV0ZQ0KICAgOiBUQkQNCg0KICAgVGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZSBj YXJyaWVzIHRoZSBzZWN1cmVkIGluZm9ybWF0aW9uIHJlZ2FyZGluZw0KICAgdGhlIHBhdGggb2Yg QVNlcyB0aHJvdWdoIHdoaWNoIGFuIHVwZGF0ZSBtZXNzYWdlIHBhc3Nlcy4gIFRoaXMNCiAgIGlu Y2x1ZGVzIHRoZSBkaWdpdGFsIHNpZ25hdHVyZXMgdXNlZCB0byBwcm90ZWN0IHRoZSBwYXRoIGlu Zm9ybWF0aW9uLg0KICAgIFdlIHJlZmVyIHRvIHRob3NlIHVwZGF0ZSBtZXNzYWdlcyB0aGF0IGNv bnRhaW4gdGhlIEJHUHNlY19QYXRoDQogICBhdHRyaWJ1dGUgYXMgIkJHUHNlYyBVcGRhdGUgbWVz c2FnZXMiLiAgVGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZQ0KICAgcmVwbGFjZXMgdGhlIEFTX1BB VEggYXR0cmlidXRlIGluIGEgQkdQc2VjIHVwZGF0ZSBtZXNzYWdlLiAgVGhhdCBpcywNCiAgIHVw ZGF0ZSBtZXNzYWdlcyB0aGF0IGNvbnRhaW4gdGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZSBNVVNU IE5PVA0KICAgY29udGFpbiB0aGUgQVNfUEFUSCBhdHRyaWJ1dGUsIGFuZCB2aWNlIHZlcnNhLg0K DQogICBUaGUgQkdQc2VjX1BhdGggYXR0cmlidXRlIGlzIG1hZGUgdXAgb2Ygc2V2ZXJhbCBwYXJ0 cy4gIFRoZSBmb2xsb3dpbmcNCiAgIGhpZ2gtbGV2ZWwgZGlhZ3JhbSBwcm92aWRlcyBhbiBvdmVy dmlldyBvZiB0aGUgc3RydWN0dXJlIG9mIHRoZQ0KICAgQkdQc2VjX1BhdGggYXR0cmlidXRlOg0K DQogICAgICAgICAgICAgIEhpZ2gtTGV2ZWwgRGlhZ3JhbSBvZiB0aGUgQkdQc2VjX1BhdGggQXR0 cmlidXRlDQogICAgICAgICstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0rDQogICAgICAgIHwgICAgICstLS0tLS0tLS0tLS0tLS0tLSsgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8DQogICAgICAgIHwgICAgIHwgICBTZWN1cmUg UGF0aCAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8DQogICAgICAgIHwgICAg ICstLS0tLS0tLS0tLS0tLS0tLSsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8DQog ICAgICAgIHwgICAgIHwgICAgQVMgWCAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8DQogICAgICAgIHwgICAgIHwgICAgcENvdW50IFggICAgIHwgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICB8DQogICAgICAgIHwgICAgIHwgICAgRmxhZ3MgWCAgICAgIHwg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8DQogICAgICAgIHwgICAgIHwgICAgQVMg WSAgICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8DQogICAgICAgIHwg ICAgIHwgICAgcENvdW50IFkgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8 DQogICAgICAgIHwgICAgIHwgICAgRmxhZ3MgWSAgICAgIHwgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICB8DQogICAgICAgIHwgICAgIHwgICAgICAuLi4gICAgICAgIHwgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICB8DQogICAgICAgIHwgICAgICstLS0tLS0tLS0tLS0tLS0t LSsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8DQogICAgICAgIHwgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8DQogICAgICAg IHwgICAgICstLS0tLS0tLS0tLS0tLS0tLSsgICAgICAgKy0tLS0tLS0tLS0tLS0tLS0tKyAgICAg ICB8DQogICAgICAgIHwgICAgIHwgU2lnIEJsb2NrIDEgICAgIHwgICAgICAgfCAgU2lnIEJsb2Nr IDIgICAgfCAgICAgICB8DQogICAgICAgIHwgICAgICstLS0tLS0tLS0tLS0tLS0tLSsgICAgICAg Ky0tLS0tLS0tLS0tLS0tLS0tKyAgICAgICB8DQogICAgICAgIHwgICAgIHwgQWxnIFN1aXRlIDEg ICAgIHwgICAgICAgfCAgQWxnIFN1aXRlIDIgICAgfCAgICAgICB8DQogICAgICAgIHwgICAgIHwg U0tJIFgxICAgICAgICAgIHwgICAgICAgfCAgU0tJIFgxICAgICAgICAgfCAgICAgICB8DQogICAg ICAgIHwgICAgIHwgU2lnbmF0dXJlIFgxICAgIHwgICAgICAgfCAgU2lnbmF0dXJlIFgxICAgfCAg ICAgICB8DQogICAgICAgIHwgICAgIHwgU0tJIFkxICAgICAgICAgIHwgICAgICAgfCAgU0tJIFkx ICAgICAgICAgfCAgICAgICB8DQogICAgICAgIHwgICAgIHwgU2lnbmF0dXJlIFkxICAgIHwgICAg ICAgfCAgU2lnbmF0dXJlIFkxICAgfCAgICAgICB8DQogICAgICAgIHwgICAgIHwgICAgICAuLi4g ICAgICAgIHwgICAgICAgfCAgICAgIC4uLi4gICAgICAgfCAgICAgICB8DQogICAgICAgIHwgICAg ICstLS0tLS0tLS0tLS0tLS0tLSsgICAgICAgKy0tLS0tLS0tLS0tLS0tLS0tKyAgICAgICB8DQog ICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8DQogICAgICAgICstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0rDQoNCiANCg0KDQpMZXBpbnNraSAgICAgICAgICAgICAgICAg IEV4cGlyZXMgTWF5IDYsIDIwMTYgICAgICAgICAgICAgICAgICAgW1BhZ2UgNl0NCgwNCkludGVy bmV0LURyYWZ0ICAgICAgICAgICAgICBCR1BzZWMgUHJvdG9jb2wgICAgICAgICAgICAgRGVjZW1i ZXIgNiwgMjAxNQ0KDQoNCiAgIFRoZSBmb2xsb3dpbmcgaXMgdGhlIHNwZWNpZmljYXRpb24gb2Yg dGhlIGZvcm1hdCBmb3IgdGhlIEJHUHNlY19QYXRoDQogICBhdHRyaWJ1dGUuDQoNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgIEJHUHNlY19QYXRoIEF0dHJpYnV0ZQ0KDQogICAgICAgICArLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsNCiAg ICAgICAgIHwgU2VjdXJlX1BhdGggICAgICAgICAgICAgICAgICAgICAgICAgICAgICh2YXJpYWJs ZSkgICAgfA0KICAgICAgICAgKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0rDQogICAgICAgICB8IFNlcXVlbmNlIG9mIG9uZSBvciB0d28gU2ln bmF0dXJlX0Jsb2NrcyAodmFyaWFibGUpICAgIHwNCiAgICAgICAgICstLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKw0KDQoNCiAgIFRoZSBTZWN1 cmVfUGF0aCBjb250YWlucyBBUyBwYXRoIGluZm9ybWF0aW9uIGZvciB0aGUgQkdQc2VjIHVwZGF0 ZQ0KICAgbWVzc2FnZS4gIFRoaXMgaXMgbG9naWNhbGx5IGVxdWl2YWxlbnQgdG8gdGhlIGluZm9y bWF0aW9uIHRoYXQgaXMNCiAgIGNvbnRhaW5lZCBpbiBhIG5vbi1CR1BzZWMgQVNfUEFUSCBhdHRy aWJ1dGUuIFRoZSBpbmZvcm1hdGlvbiBpbg0KICAgU2VjdXJlX1BhdGggaXMgdXNlZCBieSBCR1Bz ZWMgc3BlYWtlcnMgaW4gdGhlIHNhbWUgd2F5IHRoYXQNCiAgIGluZm9ybWF0aW9uIGZyb20gdGhl IEFTX1BBVEggaXMgdXNlZCBieSBub24tQkdQc2VjIHNwZWFrZXJzLiBUaGUNCiAgIGZvcm1hdCBv ZiB0aGUgU2VjdXJlX1BhdGggaXMgZGVzY3JpYmVkIGJlbG93IGluIFNlY3Rpb24gMy4xLg0KDQog ICBUaGUgQkdQc2VjX1BhdGggYXR0cmlidXRlIHdpbGwgY29udGFpbiBvbmUgb3IgdHdvIFNpZ25h dHVyZV9CbG9ja3MsDQogICBlYWNoIG9mIHdoaWNoIGNvcnJlc3BvbmRzIHRvIGEgZGlmZmVyZW50 IGFsZ29yaXRobSBzdWl0ZS4gIEVhY2ggb2YNCiAgIHRoZSBTaWduYXR1cmVfQmxvY2tzIHdpbGwg Y29udGFpbiBhIHNpZ25hdHVyZSBzZWdtZW50IGZvciBlYWNoIEFTDQogICBudW1iZXIgKGkuZS4s IFNlY3VyZV9QYXRoIHNlZ21lbnQpIGluIHRoZSBTZWN1cmVfUGF0aC4gIEluIHRoZSBtb3N0DQog ICBjb21tb24gY2FzZSwgdGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZSB3aWxsIGNvbnRhaW4gb25s eSBhIHNpbmdsZQ0KICAgU2lnbmF0dXJlX0Jsb2NrLiAgSG93ZXZlciwgaW4gb3JkZXIgdG8gZW5h YmxlIGEgdHJhbnNpdGlvbiBmcm9tIGFuDQogICBvbGQgYWxnb3JpdGhtIHN1aXRlIHRvIGEgbmV3 IGFsZ29yaXRobSBzdWl0ZSAod2l0aG91dCBhIGZsYWcgZGF5KSwgaXQNCiAgIHdpbGwgYmUgbmVj ZXNzYXJ5IHRvIGluY2x1ZGUgdHdvIFNpZ25hdHVyZV9CbG9ja3MgKG9uZSBmb3IgdGhlIG9sZA0K ICAgYWxnb3JpdGhtIHN1aXRlIGFuZCBvbmUgZm9yIHRoZSBuZXcgYWxnb3JpdGhtIHN1aXRlKSBk dXJpbmcgdGhlDQogICB0cmFuc2l0aW9uIHBlcmlvZC4gIChTZWUgU2VjdGlvbiA2LjEgZm9yIG1v cmUgZGlzY3Vzc2lvbiBvZiBhbGdvcml0aG0NCiAgIHRyYW5zaXRpb25zLikgIFRoZSBmb3JtYXQg b2YgdGhlIFNpZ25hdHVyZV9CbG9ja3MgaXMgZGVzY3JpYmVkIGJlbG93DQogICBpbiBTZWN0aW9u IDMuMi4NCg0KMy4xLiAgU2VjdXJlX1BhdGgNCg0KICAgSGVyZSB3ZSBwcm92aWRlIGEgZGV0YWls ZWQgZGVzY3JpcHRpb24gb2YgdGhlIFNlY3VyZV9QYXRoIGluZm9ybWF0aW9uDQogICBpbiB0aGUg QkdQc2VjX1BhdGggYXR0cmlidXRlLg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IFNlY3VyZV9QYXRoDQoNCiAgICAgICAgICAgICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0rDQogICAgICAgICAgICAgfCBTZWN1cmVfUGF0aCBMZW5ndGgg ICAgICAgICAgICAgICAgICgyIG9jdGV0cykgfA0KICAgICAgICAgICAgICstLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsNCiAgICAgICAgICAgICB8IE9uZSBv ciBNb3JlIFNlY3VyZV9QYXRoIFNlZ21lbnRzICAgKHZhcmlhYmxlKSB8DQogICAgICAgICAgICAg Ky0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKw0KDQoNCiAg IFRoZSBTZWN1cmVfUGF0aCBMZW5ndGggY29udGFpbnMgdGhlIGxlbmd0aCAoaW4gb2N0ZXRzKSBv ZiB0aGUgZW50aXJlDQogICBTZWN1cmVfUGF0aCAoaW5jbHVkaW5nIHRoZSB0d28gb2N0ZXRzIHVz ZWQgdG8gZXhwcmVzcyB0aGlzIGxlbmd0aA0KIA0KDQoNCkxlcGluc2tpICAgICAgICAgICAgICAg ICAgRXhwaXJlcyBNYXkgNiwgMjAxNiAgICAgICAgICAgICAgICAgICBbUGFnZSA3XQ0KDA0KSW50 ZXJuZXQtRHJhZnQgICAgICAgICAgICAgIEJHUHNlYyBQcm90b2NvbCAgICAgICAgICAgICBEZWNl bWJlciA2LCAyMDE1DQoNCg0KICAgZmllbGQpLiAgQXMgZXhwbGFpbmVkIGJlbG93LCBlYWNoIFNl Y3VyZV9QYXRoIHNlZ21lbnQgaXMgc2l4IG9jdGV0cw0KICAgbG9uZy4gIE5vdGUgdGhhdCB0aGlz IG1lYW5zIHRoZSBTZWN1cmVfUGF0aCBMZW5ndGggaXMgdHdvIGdyZWF0ZXINCiAgIHRoYW4gc2l4 IHRpbWVzIHRoZSBudW1iZXIgU2VjdXJlX1BhdGggU2VnbWVudHMgKGkuZS4sIHRoZSBudW1iZXIg b2YNCiAgIEFTIG51bWJlcnMgaW4gdGhlIHBhdGgpLg0KDQogICBUaGUgU2VjdXJlX1BhdGggY29u dGFpbnMgb25lIFNlY3VyZV9QYXRoIFNlZ21lbnQgZm9yIGVhY2ggKGRpc3RpbmN0KQ0KICAgQXV0 b25vbW91cyBTeXN0ZW0gaW4gdGhlIHBhdGggdG8gdGhlIG9yaWdpbmF0aW5nIEFTIG9mIHRoZSBO TFJJDQogICBzcGVjaWZpZWQgaW4gdGhlIHVwZGF0ZSBtZXNzYWdlLg0KDQogICAgICAgICAgICAg ICAgICAgICAgICAgICAgU2VjdXJlX1BhdGggU2VnbWVudA0KDQogICAgICAgICAgICAgICAgICAg ICAgICstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKw0KICAgICAgICAgICAgICAgICAgICAg ICB8IEFTIE51bWJlciAgICAgICg0IG9jdGV0cykgIHwNCiAgICAgICAgICAgICAgICAgICAgICAg Ky0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rDQogICAgICAgICAgICAgICAgICAgICAgIHwg cENvdW50ICAgICAgICAgKDEgb2N0ZXQpICAgfA0KICAgICAgICAgICAgICAgICAgICAgICArLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsNCiAgICAgICAgICAgICAgICAgICAgICAgfCBGbGFn cyAgICAgICAgICAoMSBvY3RldCkgICB8DQogICAgICAgICAgICAgICAgICAgICAgICstLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tKw0KDQoNCiAgIFRoZSBBUyBOdW1iZXIgaXMgdGhlIEFTIG51 bWJlciBvZiB0aGUgQkdQIHNwZWFrZXIgdGhhdCBhZGRlZCB0aGlzDQogICBTZWN1cmVfUGF0aCBz ZWdtZW50IHRvIHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUuICAoU2VlIFNlY3Rpb24gNCBmb3IN CiAgIG1vcmUgaW5mb3JtYXRpb24gb24gcG9wdWxhdGluZyB0aGlzIGZpZWxkLikNCg0KICAgVGhl IHBDb3VudCBmaWVsZCBjb250YWlucyB0aGUgbnVtYmVyIG9mIHJlcGV0aXRpb25zIG9mIHRoZSBh c3NvY2lhdGVkDQogICBhdXRvbm9tb3VzIHN5c3RlbSBudW1iZXIgdGhhdCB0aGUgc2lnbmF0dXJl IGNvdmVycy4gIFRoaXMgZmllbGQNCiAgIGVuYWJsZXMgYSBCR1BzZWMgc3BlYWtlciB0byBtaW1p YyB0aGUgc2VtYW50aWNzIG9mIHByZXBlbmRpbmcNCiAgIG11bHRpcGxlIGNvcGllcyBvZiB0aGVp ciBBUyB0byB0aGUgQVNfUEFUSCB3aXRob3V0IHJlcXVpcmluZyB0aGUNCiAgIHNwZWFrZXIgdG8g Z2VuZXJhdGUgbXVsdGlwbGUgc2lnbmF0dXJlcy4gVGhlIHBDb3VudCBmaWVsZCBpcyBhbHNvDQog ICB1c2VmdWwgaW4gbWFuYWdpbmcgcm91dGUgc2VydmVycyAoc2VlIFNlY3Rpb24gNC4yKSBhbmQg QVMgTnVtYmVyDQogICBtaWdyYXRpb25zLCBzZWUgWzE4XSBmb3IgZGV0YWlscy4NCg0KICAgVGhl IGZpcnN0IGJpdCBvZiB0aGUgRmxhZ3MgZmllbGQgaXMgdGhlIENvbmZlZF9TZWdtZW50IGZsYWcu ICBUaGUNCiAgIENvbmZlZF9TZWdtZW50IGZsYWcgaXMgc2V0IHRvIG9uZSB0byBpbmRpY2F0ZSB0 aGF0IHRoZSBCR1BzZWMgc3BlYWtlcg0KICAgdGhhdCBjb25zdHJ1Y3RlZCB0aGlzIFNlY3VyZV9Q YXRoIHNlZ21lbnQgaXMgc2VuZGluZyB0aGUgdXBkYXRlDQogICBtZXNzYWdlIHRvIGEgcGVlciBB UyB3aXRoaW4gdGhlIHNhbWUgQXV0b25vbW91cyBTeXN0ZW0gY29uZmVkZXJhdGlvbg0KICAgWzVd LiAgKFRoYXQgaXMsIHRoZSBDb25mZWRfU2VnbWVudCBmbGFnIGlzIHNldCBpbiBhIEJHUHNlYyB1 cGRhdGUNCiAgIG1lc3NhZ2Ugd2hlbmV2ZXIsIGluIGEgbm9uLUJHUHNlYyB1cGRhdGUgbWVzc2Fn ZSwgdGhlIEJHUCBzcGVha2VyJ3MNCiAgIEFTIHdvdWxkIGFwcGVhciBpbiBhIEFTX1BBVEggc2Vn bWVudCBvZiB0eXBlIEFTX0NPTkZFRF9TRVFVRU5DRS4pICBJbg0KICAgYWxsIG90aGVyIGNhc2Vz IHRoZSBDb25mZWRfU2VnbWVudCBmbGFnIGlzIHNldCB0byB6ZXJvLg0KDQogICBUaGUgcmVtYWlu aW5nIHNldmVuIGJpdHMgb2YgdGhlIEZsYWdzIE1VU1QgYmUgc2V0IHRvIHplcm8gYnkgdGhlDQog ICBzZW5kZXIsIGFuZCBpZ25vcmVkIGJ5IHRoZSByZWNlaXZlci4gIE5vdGUsIGhvd2V2ZXIsIHRo YXQgdGhlDQogICBzaWduYXR1cmUgaXMgY29tcHV0ZWQgb3ZlciBhbGwgZWlnaHQgYml0cyBvZiB0 aGUgZmxhZ3MgZmllbGQuDQoNCjMuMi4gIFNpZ25hdHVyZV9CbG9jaw0KDQogICBIZXJlIHdlIHBy b3ZpZGUgYSBkZXRhaWxlZCBkZXNjcmlwdGlvbiBvZiB0aGUgU2lnbmF0dXJlX0Jsb2NrcyBpbiB0 aGUNCiANCg0KDQpMZXBpbnNraSAgICAgICAgICAgICAgICAgIEV4cGlyZXMgTWF5IDYsIDIwMTYg ICAgICAgICAgICAgICAgICAgW1BhZ2UgOF0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgICAgICAg ICBCR1BzZWMgUHJvdG9jb2wgICAgICAgICAgICAgRGVjZW1iZXIgNiwgMjAxNQ0KDQoNCiAgIEJH UHNlY19QYXRoIGF0dHJpYnV0ZS4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU2ln bmF0dXJlX0Jsb2NrDQoNCiAgICAgICAgICAgICAgKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLSsNCiAgICAgICAgICAgICAgfCBTaWduYXR1cmVfQmxvY2sgTGVu Z3RoICAgICAgICAgKDIgb2N0ZXRzKSAgIHwNCiAgICAgICAgICAgICAgKy0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsNCiAgICAgICAgICAgICAgfCBBbGdvcml0 aG0gU3VpdGUgSWRlbnRpZmllciAgICAgKDEgb2N0ZXQpICAgIHwNCiAgICAgICAgICAgICAgKy0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsNCiAgICAgICAgICAg ICAgfCBTZXF1ZW5jZSBvZiBTaWduYXR1cmUgU2VnbWVudHMgKHZhcmlhYmxlKSAgIHwNCiAgICAg ICAgICAgICAgKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsN Cg0KDQogICBUaGUgU2lnbmF0dXJlX0Jsb2NrIExlbmd0aCBpcyB0aGUgdG90YWwgbnVtYmVyIG9m IG9jdGV0cyBpbiB0aGUNCiAgIFNpZ25hdHVyZV9CbG9jayAoaW5jbHVkaW5nIHRoZSB0d28gb2N0 ZXRzIHVzZWQgdG8gZXhwcmVzcyB0aGlzIGxlbmd0aA0KICAgZmllbGQpLg0KDQogICBUaGUgQWxn b3JpdGhtIFN1aXRlIElkZW50aWZpZXIgaXMgYSBvbmUtb2N0ZXQgaWRlbnRpZmllciBzcGVjaWZ5 aW5nDQogICB0aGUgZGlnZXN0IGFsZ29yaXRobSBhbmQgZGlnaXRhbCBzaWduYXR1cmUgYWxnb3Jp dGhtIHVzZWQgdG8gcHJvZHVjZQ0KICAgdGhlIGRpZ2l0YWwgc2lnbmF0dXJlIGluIGVhY2ggU2ln bmF0dXJlIFNlZ21lbnQuICBBbiBJQU5BIHJlZ2lzdHJ5IG9mDQogICBhbGdvcml0aG0gaWRlbnRp ZmllcnMgZm9yIHVzZSBpbiBCR1BzZWMgaXMgc3BlY2lmaWVkIGluIHRoZSBCR1BzZWMNCiAgIGFs Z29yaXRobXMgZG9jdW1lbnQgWzEwXS4NCg0KICAgQSBTaWduYXR1cmVfQmxvY2sgaGFzIGV4YWN0 bHkgb25lIFNpZ25hdHVyZSBTZWdtZW50IGZvciBlYWNoDQogICBTZWN1cmVfUGF0aCBTZWdtZW50 IGluIHRoZSBTZWN1cmVfUGF0aCBwb3J0aW9uIG9mIHRoZSBCR1BzZWNfUGF0aA0KICAgQXR0cmli dXRlLiAgKFRoYXQgaXMsIG9uZSBTaWduYXR1cmUgU2VnbWVudCBmb3IgZWFjaCBkaXN0aW5jdCBB UyBvbg0KICAgdGhlIHBhdGggZm9yIHRoZSBOTFJJIGluIHRoZSBVcGRhdGUgbWVzc2FnZS4pDQoN CiAgICAgICAgICAgICAgICAgICAgICAgICAgICBTaWduYXR1cmUgU2VnbWVudHMNCiAgICAgICAg ICAgICAgKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsNCiAg ICAgICAgICAgICAgfCBTdWJqZWN0IEtleSBJZGVudGlmaWVyICAgICAgICAoMjAgb2N0ZXRzKSAg IHwNCiAgICAgICAgICAgICAgKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLSsNCiAgICAgICAgICAgICAgfCBTaWduYXR1cmUgTGVuZ3RoICAgICAgICAgICAgICAo MiBvY3RldHMpICAgIHwNCiAgICAgICAgICAgICAgKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLSsNCiAgICAgICAgICAgICAgfCBTaWduYXR1cmUgICAgICAgICAg ICAgICAgICAgICAodmFyaWFibGUpICAgIHwNCiAgICAgICAgICAgICAgKy0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsNCg0KDQogICBUaGUgU3ViamVjdCBLZXkg SWRlbnRpZmllciBjb250YWlucyB0aGUgdmFsdWUgaW4gdGhlIFN1YmplY3QgS2V5DQogICBJZGVu dGlmaWVyIGV4dGVuc2lvbiBvZiB0aGUgUlBLSSByb3V0ZXIgY2VydGlmaWNhdGUgWzldIHRoYXQg aXMgdXNlZA0KICAgdG8gdmVyaWZ5IHRoZSBzaWduYXR1cmUgKHNlZSBTZWN0aW9uIDUgZm9yIGRl dGFpbHMgb24gdmFsaWRpdHkgb2YNCiAgIEJHUHNlYyB1cGRhdGUgbWVzc2FnZXMpLg0KDQogICBU aGUgU2lnbmF0dXJlIExlbmd0aCBmaWVsZCBjb250YWlucyB0aGUgc2l6ZSAoaW4gb2N0ZXRzKSBv ZiB0aGUgdmFsdWUNCiAgIGluIHRoZSBTaWduYXR1cmUgZmllbGQgb2YgdGhlIFNpZ25hdHVyZSBT ZWdtZW50Lg0KDQogICBUaGUgU2lnbmF0dXJlIGNvbnRhaW5zIGEgZGlnaXRhbCBzaWduYXR1cmUg dGhhdCBwcm90ZWN0cyB0aGUgTkxSSSBhbmQNCiAgIHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUg KHNlZSBTZWN0aW9ucyA0IGFuZCA1IGZvciBkZXRhaWxzIG9uDQogDQoNCg0KTGVwaW5za2kgICAg ICAgICAgICAgICAgICBFeHBpcmVzIE1heSA2LCAyMDE2ICAgICAgICAgICAgICAgICAgIFtQYWdl IDldDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgQkdQc2VjIFByb3RvY29sICAgICAg ICAgICAgIERlY2VtYmVyIDYsIDIwMTUNCg0KDQogICBzaWduYXR1cmUgZ2VuZXJhdGlvbiBhbmQg dmFsaWRhdGlvbiwgcmVzcGVjdGl2ZWx5KS4NCg0KNC4gIEJHUHNlYyBVcGRhdGUgTWVzc2FnZXMN Cg0KICAgU2VjdGlvbiA0LjEgcHJvdmlkZXMgZ2VuZXJhbCBndWlkYW5jZSBvbiB0aGUgY3JlYXRp b24gb2YgQkdQc2VjDQogICBVcGRhdGUgTWVzc2FnZXMgLS0gdGhhdCBpcywgdXBkYXRlIG1lc3Nh Z2VzIGNvbnRhaW5pbmcgdGhlDQogICBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUuDQoNCiAgIFNlY3Rp b24gNC4yIHNwZWNpZmllcyBob3cgYSBCR1BzZWMgc3BlYWtlciBnZW5lcmF0ZXMgdGhlIEJHUHNl Y19QYXRoDQogICBhdHRyaWJ1dGUgdG8gaW5jbHVkZSBpbiBhIEJHUHNlYyBVcGRhdGUgbWVzc2Fn ZS4NCg0KICAgU2VjdGlvbiA0LjMgY29udGFpbnMgc3BlY2lhbCBwcm9jZXNzaW5nIGluc3RydWN0 aW9ucyBmb3IgbWVtYmVycyBvZg0KICAgYW4gYXV0b25vbW91cyBzeXN0ZW0gY29uZmVkZXJhdGlv biBbNV0uIEEgQkdQc2VjIHNwZWFrZXIgdGhhdCBpcyBub3QNCiAgIGEgbWVtYmVyIG9mIHN1Y2gg YSBjb25mZWRlcmF0aW9uIE1VU1Qgc2V0IHRoZSBGbGFncyBmaWVsZCBvZiB0aGUNCiAgIFNlY3Vy ZV9QYXRoIFNlZ21lbnQgdG8gemVybyBpbiBhbGwgQkdQc2VjIHVwZGF0ZSBtZXNzYWdlcyBpdCBz ZW5kcy4NCg0KICAgU2VjdGlvbiA0LjQgY29udGFpbnMgaW5zdHJ1Y3Rpb25zIGZvciByZWNvbnN0 cnVjdGluZyB0aGUgQVNfUGF0aA0KICAgYXR0cmlidXRlIGluIGNhc2VzIHdoZXJlIGEgQkdQc2Vj IHNwZWFrZXIgcmVjZWl2ZXMgYW4gdXBkYXRlIG1lc3NhZ2UNCiAgIHdpdGggYSBCR1BzZWNfUGF0 aCBhdHRyaWJ1dGUgYW5kIHdpc2hlcyB0byBwcm9wYWdhdGUgdGhlIHVwZGF0ZQ0KICAgbWVzc2Fn ZSB0byBhIHBlZXIgd2hvIGRvZXMgbm90IHN1cHBvcnQgQkdQc2VjLg0KDQo0LjEuICBHZW5lcmFs IEd1aWRhbmNlDQoNCiAgIFRoZSBpbmZvcm1hdGlvbiBwcm90ZWN0ZWQgYnkgdGhlIHNpZ25hdHVy ZSBvbiBhIEJHUHNlYyB1cGRhdGUgbWVzc2FnZQ0KICAgaW5jbHVkZXMgdGhlIEFTIG51bWJlciBv ZiB0aGUgcGVlciB0byB3aG9tIHRoZSB1cGRhdGUgbWVzc2FnZSBpcw0KICAgYmVpbmcgc2VudC4g IFRoZXJlZm9yZSwgaWYgYSBCR1BzZWMgc3BlYWtlciB3aXNoZXMgdG8gc2VuZCBhIEJHUHNlYw0K ICAgdXBkYXRlIHRvIG11bHRpcGxlIEJHUCBwZWVycywgaXQgTVVTVCBnZW5lcmF0ZSBhIHNlcGFy YXRlIEJHUHNlYw0KICAgdXBkYXRlIG1lc3NhZ2UgZm9yIGVhY2ggdW5pcXVlIHBlZXIgQVMgdG8g d2hvbSB0aGUgdXBkYXRlIG1lc3NhZ2UgaXMNCiAgIHNlbnQuDQoNCiAgIEEgQkdQc2VjIHVwZGF0 ZSBtZXNzYWdlIE1VU1QgYWR2ZXJ0aXNlIGEgcm91dGUgdG8gb25seSBhIHNpbmdsZSBOTFJJLg0K ICAgVGhpcyBpcyBiZWNhdXNlIGEgQkdQc2VjIHNwZWFrZXIgcmVjZWl2aW5nIGFuIHVwZGF0ZSBt ZXNzYWdlIHdpdGgNCiAgIG11bHRpcGxlIE5MUkkgd291bGQgYmUgdW5hYmxlIHRvIGNvbnN0cnVj dCBhIHZhbGlkIEJHUHNlYyB1cGRhdGUNCiAgIG1lc3NhZ2UgKGkuZS4sIHZhbGlkIHBhdGggc2ln bmF0dXJlcykgY29udGFpbmluZyBhIHN1YnNldCBvZiB0aGUgTkxSSQ0KICAgaW4gdGhlIHJlY2Vp dmVkIHVwZGF0ZS4gIElmIGEgQkdQc2VjIHNwZWFrZXIgd2lzaGVzIHRvIGFkdmVydGlzZQ0KICAg cm91dGVzIHRvIG11bHRpcGxlIE5MUkksIHRoZW4gaXQgTVVTVCBnZW5lcmF0ZSBhIHNlcGFyYXRl IEJHUHNlYw0KICAgdXBkYXRlIG1lc3NhZ2UgZm9yIGVhY2ggTkxSSS4gQWRkaXRpb25hbGx5LCBh IEJHUHNlYyB1cGRhdGUgbWVzc2FnZQ0KICAgTVVTVCB1c2UgdGhlIE1QX1JFQUNIX05MUkkgWzNd IGF0dHJpYnV0ZSB0byBlbmNvZGUgdGhlIE5MUkkuDQoNCiAgIFRoZSBCR1BzZWNfUGF0aCBhdHRy aWJ1dGUgYW5kIHRoZSBBU19QYXRoIGF0dHJpYnV0ZSBhcmUgbXV0dWFsbHkNCiAgIGV4Y2x1c2l2 ZS4gIFRoYXQgaXMsIGFueSB1cGRhdGUgbWVzc2FnZSBjb250YWluaW5nIHRoZSBCR1BzZWNfUGF0 aA0KICAgYXR0cmlidXRlIE1VU1QgTk9UIGNvbnRhaW4gdGhlIEFTX1BhdGggYXR0cmlidXRlLiAg VGhlIGluZm9ybWF0aW9uDQogICB0aGF0IHdvdWxkIGJlIGNvbnRhaW5lZCBpbiB0aGUgQVNfUGF0 aCBhdHRyaWJ1dGUgaXMgaW5zdGVhZCBjb252ZXllZA0KICAgaW4gdGhlIFNlY3VyZV9QYXRoIHBv cnRpb24gb2YgdGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZS4NCg0KICAgSW4gb3JkZXIgdG8gY3Jl YXRlIG9yIGFkZCBhIG5ldyBzaWduYXR1cmUgdG8gYSBCR1BzZWMgdXBkYXRlIG1lc3NhZ2UNCiAg IHdpdGggYSBnaXZlbiBhbGdvcml0aG0gc3VpdGUsIHRoZSBCR1BzZWMgc3BlYWtlciBtdXN0IHBv c3Nlc3MgYQ0KICAgcHJpdmF0ZSBrZXkgc3VpdGFibGUgZm9yIGdlbmVyYXRpbmcgc2lnbmF0dXJl cyBmb3IgdGhpcyBhbGdvcml0aG0NCiANCg0KDQpMZXBpbnNraSAgICAgICAgICAgICAgICAgIEV4 cGlyZXMgTWF5IDYsIDIwMTYgICAgICAgICAgICAgICAgICBbUGFnZSAxMF0NCgwNCkludGVybmV0 LURyYWZ0ICAgICAgICAgICAgICBCR1BzZWMgUHJvdG9jb2wgICAgICAgICAgICAgRGVjZW1iZXIg NiwgMjAxNQ0KDQoNCiAgIHN1aXRlLiAgQWRkaXRpb25hbGx5LCB0aGlzIHByaXZhdGUga2V5IG11 c3QgY29ycmVzcG9uZCB0byB0aGUgcHVibGljDQogICBrZXkgaW4gYSB2YWxpZCBSZXNvdXJjZSBQ S0kgZW5kLWVudGl0eSBjZXJ0aWZpY2F0ZSB3aG9zZSBBUyBudW1iZXINCiAgIHJlc291cmNlIGV4 dGVuc2lvbiBpbmNsdWRlcyB0aGUgQkdQc2VjIHNwZWFrZXIncyBBUyBudW1iZXIgWzldLiBOb3Rl DQogICBhbHNvIHRoYXQgbmV3IHNpZ25hdHVyZXMgYXJlIG9ubHkgYWRkZWQgdG8gYSBCR1BzZWMg dXBkYXRlIG1lc3NhZ2UNCiAgIHdoZW4gYSBCR1BzZWMgc3BlYWtlciBpcyBnZW5lcmF0aW5nIGFu IHVwZGF0ZSBtZXNzYWdlIHRvIHNlbmQgdG8gYW4NCiAgIGV4dGVybmFsIHBlZXIgKGkuZS4sIHdo ZW4gdGhlIEFTIG51bWJlciBvZiB0aGUgcGVlciBpcyBub3QgZXF1YWwgdG8NCiAgIHRoZSBCR1Bz ZWMgc3BlYWtlcidzIG93biBBUyBudW1iZXIpLiAgVGhlcmVmb3JlLCBhIEJHUHNlYyBzcGVha2Vy IHdobw0KICAgb25seSBzZW5kcyBCR1BzZWMgdXBkYXRlIG1lc3NhZ2VzIHRvIHBlZXJzIHdpdGhp biBpdHMgb3duIEFTLCBpdCBkb2VzDQogICBub3QgbmVlZCB0byBwb3NzZXNzIGFueSBwcml2YXRl IHNpZ25hdHVyZSBrZXlzLg0KDQogICBUaGUgUmVzb3VyY2UgUEtJIGVuYWJsZXMgdGhlIGxlZ2l0 aW1hdGUgaG9sZGVyIG9mIElQIGFkZHJlc3MNCiAgIHByZWZpeChlcykgdG8gaXNzdWUgYSBzaWdu ZWQgb2JqZWN0LCBjYWxsZWQgYSBSb3V0ZSBPcmlnaW5hdGlvbg0KICAgQXV0aG9yaXphdGlvbiAo Uk9BKSwgdGhhdCBhdXRob3JpemVzIGEgZ2l2ZW4gQVMgdG8gb3JpZ2luYXRlIHJvdXRlcw0KICAg dG8gYSBnaXZlbiBzZXQgb2YgcHJlZml4ZXMgKHNlZSBbN10pLiBJdCBpcyBleHBlY3RlZCB0aGF0 IG1vc3QNCiAgIHJlbHlpbmcgcGFydGllcyB3aWxsIHV0aWxpemUgQkdQc2VjIGluIHRhbmRlbSB3 aXRoIG9yaWdpbiB2YWxpZGF0aW9uDQogICAoc2VlIFsxOV0gYW5kIFsyMF0pLiBUaGVyZWZvcmUs IGl0IGlzIFJFQ09NTUVOREVEIHRoYXQgYSBCR1BzZWMNCiAgIHNwZWFrZXIgb25seSBvcmlnaW5h dGUgYSBCR1BzZWMgdXBkYXRlIGFkdmVydGlzaW5nIGEgcm91dGUgZm9yIGENCiAgIGdpdmVuIHBy ZWZpeCBpZiB0aGVyZSBleGlzdHMgYSB2YWxpZCBST0EgYXV0aG9yaXppbmcgdGhlIEJHUHNlYw0K ICAgc3BlYWtlcidzIEFTIHRvIG9yaWdpbmF0ZSByb3V0ZXMgdG8gdGhpcyBwcmVmaXguDQoNCiAg IElmIGEgQkdQc2VjIHJvdXRlciBoYXMgcmVjZWl2ZWQgb25seSBhIG5vbi1CR1BzZWMgdXBkYXRl IG1lc3NhZ2UNCiAgICh3aXRob3V0IHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUpLCBjb250YWlu aW5nIHRoZSBBU19QYXRoDQogICBhdHRyaWJ1dGUsIGZyb20gYSBwZWVyIGZvciBhIGdpdmVuIHBy ZWZpeCB0aGVuIGl0IE1VU1QgTk9UIGF0dGFjaCBhDQogICBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUg d2hlbiBpdCBwcm9wYWdhdGVzIHRoZSB1cGRhdGUgbWVzc2FnZS4gIChOb3RlDQogICB0aGF0IGEg QkdQc2VjIHJvdXRlciBtYXkgYWxzbyByZWNlaXZlIGEgbm9uLUJHUHNlYyB1cGRhdGUgbWVzc2Fn ZQ0KICAgZnJvbSBhbiBpbnRlcm5hbCBwZWVyIHdpdGhvdXQgdGhlIEFTX1BhdGggYXR0cmlidXRl LCBpLmUuLCB3aXRoIGp1c3QNCiAgIHRoZSBOTFJJIGluIGl0LiAgSW4gdGhhdCBjYXNlLCB0aGUg cHJlZml4IGlzIG9yaWdpbmF0aW5nIGZyb20gdGhhdCBBUw0KICAgYW5kIGhlbmNlIHRoZSBCR1Bz ZWMgc3BlYWtlciBTSE9VTEQgc2lnbiBhbmQgZm9yd2FyZCB0aGUgdXBkYXRlIHRvDQogICBpdHMg ZXh0ZXJuYWwgQkdQc2VjLXNwZWFraW5nIHBlZXJzLikNCg0KICAgQ29udmVyc2VseSwgaWYgYSBC R1BzZWMgcm91dGVyIGhhcyByZWNlaXZlZCBhIEJHUHNlYyB1cGRhdGUgbWVzc2FnZQ0KICAgKHdp dGggdGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZSkgZnJvbSBhIHBlZXIgZm9yIGEgZ2l2ZW4gcHJl Zml4IGFuZA0KICAgaXQgY2hvb3NlcyB0byBwcm9wYWdhdGUgdGhhdCBwZWVyJ3Mgcm91dGUgZm9y IHRoZSBwcmVmaXgsIHRoZW4gaXQNCiAgIFNIT1VMRCBwcm9wYWdhdGUgdGhlIHJvdXRlIGFzIGEg QkdQc2VjIHVwZGF0ZSBtZXNzYWdlIGNvbnRhaW5pbmcgdGhlDQogICBCR1BzZWNfUGF0aCBhdHRy aWJ1dGUuDQoNCiAgIE5vdGUgdGhhdCByZW1vdmluZyBCR1BzZWMgc2lnbmF0dXJlcyAoaS5lLiwg cHJvcGFnYXRpbmcgYSByb3V0ZQ0KICAgYWR2ZXJ0aXNlbWVudCB3aXRob3V0IHRoZSBCR1BzZWNf UGF0aCBhdHRyaWJ1dGUpIGhhcyBzaWduaWZpY2FudA0KICAgc2VjdXJpdHkgcmFtaWZpY2F0aW9u cy4gIChTZWUgU2VjdGlvbiA3IGZvciBkaXNjdXNzaW9uIG9mIHRoZQ0KICAgc2VjdXJpdHkgcmFt aWZpY2F0aW9ucyBvZiByZW1vdmluZyBCR1BzZWMgc2lnbmF0dXJlcy4pICBUaGVyZWZvcmUsDQog ICB3aGVuIGEgcm91dGUgYWR2ZXJ0aXNlbWVudCBpcyByZWNlaXZlZCB2aWEgYSBCR1BzZWMgdXBk YXRlIG1lc3NhZ2UsDQogICBwcm9wYWdhdGluZyB0aGUgcm91dGUgYWR2ZXJ0aXNlbWVudCB3aXRo b3V0IHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUNCiAgIGlzIE5PVCBSRUNPTU1FTkRFRCwgdW5s ZXNzIHRoZSBtZXNzYWdlIGlzIHNlbnQgdG8gYSBwZWVyIHRoYXQgZGlkIG5vdA0KICAgYWR2ZXJ0 aXNlIHRoZSBjYXBhYmlsaXR5IHRvIHJlY2VpdmUgQkdQc2VjIHVwZGF0ZSBtZXNzYWdlcyAoc2Vl DQogICBTZWN0aW9uIDQuNCkuDQoNCiAgIEZ1cnRoZXJtb3JlLCBub3RlIHRoYXQgd2hlbiBhIEJH UHNlYyBzcGVha2VyIHByb3BhZ2F0ZXMgYSByb3V0ZQ0KICAgYWR2ZXJ0aXNlbWVudCB3aXRoIHRo ZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUgaXQgaXMgbm90IGF0dGVzdGluZyB0bw0KIA0KDQoNCkxl cGluc2tpICAgICAgICAgICAgICAgICAgRXhwaXJlcyBNYXkgNiwgMjAxNiAgICAgICAgICAgICAg ICAgIFtQYWdlIDExXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgIEJHUHNlYyBQcm90 b2NvbCAgICAgICAgICAgICBEZWNlbWJlciA2LCAyMDE1DQoNCg0KICAgdGhlIHZhbGlkYXRpb24g c3RhdGUgb2YgdGhlIHVwZGF0ZSBtZXNzYWdlIGl0IHJlY2VpdmVkLiAgKFNlZSBTZWN0aW9uDQog ICA3IGZvciBtb3JlIGRpc2N1c3Npb24gb2YgdGhlIHNlY3VyaXR5IHNlbWFudGljcyBvZiBCR1Bz ZWMNCiAgIHNpZ25hdHVyZXMuKQ0KDQogICBJZiB0aGUgQkdQc2VjIHNwZWFrZXIgaXMgcHJvZHVj aW5nIGFuIHVwZGF0ZSBtZXNzYWdlIHdoaWNoIHdvdWxkLCBpbg0KICAgdGhlIGFic2VuY2Ugb2Yg QkdQc2VjLCBjb250YWluIGFuIEFTX1NFVCAoZS5nLiwgdGhlIEJHUHNlYyBzcGVha2VyIGlzDQog ICBwZXJmb3JtaW5nIHByb3h5IGFnZ3JlZ2F0aW9uKSwgdGhlbiB0aGUgQkdQc2VjIHNwZWFrZXIg TVVTVCBOT1QNCiAgIGluY2x1ZGUgdGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZS4gIEluIHN1Y2gg YSBjYXNlLCB0aGUgQkdQc2VjDQogICBzcGVha2VyIG11c3QgcmVtb3ZlIGFueSBleGlzdGluZyBC R1BzZWNfUGF0aCBpbiB0aGUgcmVjZWl2ZWQNCiAgIGFkdmVydGlzZW1lbnQocykgZm9yIHRoaXMg cHJlZml4IGFuZCBwcm9kdWNlIGEgdHJhZGl0aW9uYWwgKG5vbi0NCiAgIEJHUHNlYykgdXBkYXRl IG1lc3NhZ2UuICBJdCBzaG91bGQgYmUgbm90ZWQgdGhhdCBCQ1AgMTcyIFsxM10NCiAgIHJlY29t bWVuZHMgYWdhaW5zdCB0aGUgdXNlIG9mIEFTX1NFVCBhbmQgQVNfQ09ORkVEX1NFVCBpbiB0aGUg QVNfUEFUSA0KICAgb2YgQkdQIHVwZGF0ZXMuDQoNCiAgIFRoZSBjYXNlIHdoZXJlIHRoZSBCR1Bz ZWMgc3BlYWtlciBzZW5kcyBhIEJHUHNlYyB1cGRhdGUgbWVzc2FnZSB0byBhbg0KICAgaW50ZXJu YWwgKGlCR1ApIHBlZXIgaXMgcXVpdGUgc2ltcGxlLiAgV2hlbiBvcmlnaW5hdGluZyBhIG5ldyBy b3V0ZQ0KICAgYWR2ZXJ0aXNlbWVudCBhbmQgc2VuZGluZyBpdCB0byBhbiBpbnRlcm5hbCBwZWVy LCB0aGUgQkdQc2VjIHNwZWFrZXINCiAgIG9taXRzIHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUu ICBXaGVuIHByb3BhZ2F0aW5nIGEgcmVjZWl2ZWQgcm91dGUNCiAgIGFkdmVydGlzZW1lbnQgdG8g YW4gaW50ZXJuYWwgcGVlciwgdGhlIEJHUHNlYyBzcGVha2VyIHR5cGljYWxseQ0KICAgcG9wdWxh dGVzIHRoZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUgYnkgY29weWluZyB0aGUgQkdQc2VjX1BhdGgN CiAgIGF0dHJpYnV0ZSBmcm9tIHRoZSByZWNlaXZlZCB1cGRhdGUgbWVzc2FnZS4gIFRoYXQgaXMs IHRoZSBCR1BzZWNfUGF0aA0KICAgYXR0cmlidXRlIGlzIGNvcGllZCB2ZXJiYXRpbS4gSG93ZXZl ciwgaW4gdGhlIGNhc2UgdGhhdCB0aGUgQkdQc2VjDQogICBzcGVha2VyIGlzIHBlcmZvcm1pbmcg YW4gQVMgTWlncmF0aW9uLCB0aGUgQkdQc2VjIHNwZWFrZXIgbWF5IGFkZCBhbg0KICAgYWRkaXRp b25hbCBzaWduYXR1cmUgb24gaW5ncmVzcyBiZWZvcmUgY29weWluZyB0aGUgQkdQc2VjX1BhdGgN CiAgIGF0dHJpYnV0ZSAoc2VlIFsxOF0gZm9yIG1vcmUgZGV0YWlscykuIE5vdGUgdGhhdCB3aGVu IGEgQkdQc2VjDQogICBzcGVha2VyIGNob29zZXMgdG8gZm9yd2FyZCBhIEJHUHNlYyB1cGRhdGUg bWVzc2FnZSB0byBhbiBpQkdQIHBlZXIsDQogICB0aGUgQkdQc2VjIGF0dHJpYnV0ZSBTSE9VTEQg Tk9UIGJlIHJlbW92ZWQsIHVubGVzcyB0aGUgcGVlciBkb2Vzbid0DQogICBzdXBwb3J0IEJHUHNl Yy4gSW4gcGFydGljdWxhciwgdGhlIEJHUHNlYyBhdHRyaWJ1dGUgU0hPVUxEIE5PVCBiZQ0KICAg cmVtb3ZlZCBldmVuIGluIHRoZSBjYXNlIHdoZXJlIHRoZSBCR1BzZWMgdXBkYXRlIG1lc3NhZ2Ug aGFzIG5vdCBiZWVuDQogICB0aGF0IGhhcyBub3Qgc3VjY2Vzc2Z1bGx5IHZhbGlkYXRlZC4gKFNl ZSBTZWN0aW9uIDUgZm9yIG1vcmUNCiAgIGluZm9ybWF0aW9uIG9uIHZhbGlkYXRpb24sIGFuZCBT ZWN0aW9uIDcgZm9yIHRoZSBzZWN1cml0eQ0KICAgcmFtaWZpY2F0aW9ucyBvZiByZW1vdmluZyBC R1BzZWMgc2lnbmF0dXJlcy4pDQoNCg0KNC4yLiAgQ29uc3RydWN0aW5nIHRoZSBCR1BzZWNfUGF0 aCBBdHRyaWJ1dGUNCg0KICAgV2hlbiBhIEJHUHNlYyBzcGVha2VyIHJlY2VpdmVzIGEgQkdQc2Vj IHVwZGF0ZSBtZXNzYWdlIGNvbnRhaW5pbmcgYQ0KICAgQkdQc2VjX1BhdGggYXR0cmlidXRlICh3 aXRoIG9uZSBvciBtb3JlIHNpZ25hdHVyZXMpIGZyb20gYW4gKGludGVybmFsDQogICBvciBleHRl cm5hbCkgcGVlciwgaXQgbWF5IGNob29zZSB0byBwcm9wYWdhdGUgdGhlIHJvdXRlIGFkdmVydGlz ZW1lbnQNCiAgIGJ5IHNlbmRpbmcgdG8gaXRzIChpbnRlcm5hbCBvciBleHRlcm5hbCkgcGVlcnMg YnkgY3JlYXRpbmcgYSBuZXcNCiAgIEJHUHNlYyBhZHZlcnRpc2VtZW50IGZvciB0aGUgc2FtZSBw cmVmaXguIFNpbWlsYXJseSwgd2hlbiBzZW5kaW5nIGENCiAgIG5ldyByb3V0ZSBhZHZlcnRpc2Vt ZW50IHRvIGFuIGV4dGVybmFsLCBCR1BzZWMtc3BlYWtpbmcgcGVlciwgdGhlDQogICBCR1BzZWMg c3BlYWtlciBtYXkgc2VuZCBhIEJHUHNlYyBVcGRhdGUgbWVzc2FnZSBieSBnZW5lcmF0aW5nIGEg bmV3DQogICBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUuDQoNCiAgIFRvIGdlbmVyYXRlIHRoZSBCR1Bz ZWNfUGF0aCBhdHRyaWJ1dGUgb24gdGhlIG91dGdvaW5nIHVwZGF0ZSBtZXNzYWdlLA0KICAgdGhl IEJHUHNlYyBzcGVha2VyIGZpcnN0IGdlbmVyYXRlcyBhIG5ldyBTZWN1cmVfUGF0aCBTZWdtZW50 LiBOb3RlDQogICB0aGF0IGlmIHRoZSBCR1BzZWMgc3BlYWtlciBpcyBub3QgdGhlIG9yaWdpbiBB UyBhbmQgdGhlcmUgaXMgYW4NCiANCg0KDQpMZXBpbnNraSAgICAgICAgICAgICAgICAgIEV4cGly ZXMgTWF5IDYsIDIwMTYgICAgICAgICAgICAgICAgICBbUGFnZSAxMl0NCgwNCkludGVybmV0LURy YWZ0ICAgICAgICAgICAgICBCR1BzZWMgUHJvdG9jb2wgICAgICAgICAgICAgRGVjZW1iZXIgNiwg MjAxNQ0KDQoNCiAgIGV4aXN0aW5nIEJHUHNlY19QYXRoIGF0dHJpYnV0ZSwgdGhlbiB0aGUgQkdQ c2VjIHNwZWFrZXIgcHJlcGVuZHMgaXRzDQogICBuZXcgU2VjdXJlX1BhdGggU2VnbWVudCAocGxh Y2VzIGluIGZpcnN0IHBvc2l0aW9uKSBvbnRvIHRoZSBleGlzdGluZw0KICAgU2VjdXJlX1BhdGgu DQoNCiAgIFRoZSBBUyBudW1iZXIgaW4gdGhpcyBTZWN1cmVfUGF0aCBzZWdtZW50IE1VU1QgbWF0 Y2ggdGhlIEFTIG51bWJlciBpbg0KICAgdGhlIEFTIG51bWJlciByZXNvdXJjZSBleHRlbnNpb24g ZmllbGQgb2YgdGhlIFJlc291cmNlIFBLSSByb3V0ZXINCiAgIGNlcnRpZmljYXRlKHMpIHRoYXQg d2lsbCBiZSB1c2VkIHRvIHZlcmlmeSB0aGUgZGlnaXRhbCBzaWduYXR1cmUocykNCiAgIGNvbnN0 cnVjdGVkIGJ5IHRoaXMgQkdQc2VjIHNwZWFrZXIgWzldLg0KDQogICBUaGUgcENvdW50IGZpZWxk IG9mIHRoZSBTZWN1cmVfUGF0aCBTZWdtZW50IGlzIHR5cGljYWxseSBzZXQgdG8gdGhlDQogICB2 YWx1ZSAxLiAgSG93ZXZlciwgYSBCR1BzZWMgc3BlYWtlciBtYXkgc2V0IHRoZSBwQ291bnQgZmll bGQgdG8gYQ0KICAgdmFsdWUgZ3JlYXRlciB0aGFuIDEuICBTZXR0aW5nIHRoZSBwQ291bnQgZmll bGQgdG8gYSB2YWx1ZSBncmVhdGVyDQogICB0aGFuIG9uZSBoYXMgdGhlIHNhbWUgc2VtYW50aWNz IGFzIHJlcGVhdGluZyBhbiBBUyBudW1iZXIgbXVsdGlwbGUNCiAgIHRpbWVzIGluIHRoZSBBU19Q QVRIIG9mIGEgbm9uLUJHUHNlYyB1cGRhdGUgbWVzc2FnZSAoZS5nLiwgZm9yDQogICB0cmFmZmlj IGVuZ2luZWVyaW5nIHB1cnBvc2VzKS4gIFNldHRpbmcgdGhlIHBDb3VudCBmaWVsZCB0byBhIHZh bHVlDQogICBncmVhdGVyIHRoYW4gb25lIHBlcm1pdHMgdGhpcyByZXBldGl0aW9uIHdpdGhvdXQg cmVxdWlyaW5nIGEgc2VwYXJhdGUNCiAgIGRpZ2l0YWwgc2lnbmF0dXJlIGZvciBlYWNoIHJlcGV0 aXRpb24uDQoNCiAgIEEgcm91dGUgc2VydmVyIHRoYXQgcGFydGljaXBhdGVzIGluIHRoZSBCR1Ag Y29udHJvbCBwYXRoLCBidXQgZG9lcw0KICAgbm90IGFjdCBhcyBhIHRyYW5zaXQgQVMgaW4gdGhl IGRhdGEgcGxhbmUsIG1heSBjaG9vc2UgdG8gc2V0IHBDb3VudA0KICAgdG8gMC4gIFRoaXMgb3B0 aW9uIGVuYWJsZXMgdGhlIHJvdXRlIHNlcnZlciB0byBwYXJ0aWNpcGF0ZSBpbiBCR1BzZWMNCiAg IGFuZCBvYnRhaW4gdGhlIGFzc29jaWF0ZWQgc2VjdXJpdHkgZ3VhcmFudGVlcyB3aXRob3V0IGlu Y3JlYXNpbmcgdGhlDQogICBlZmZlY3RpdmUgbGVuZ3RoIG9mIHRoZSBBUyBwYXRoLiAgKE5vdGUg dGhhdCBCR1BzZWMgc3BlYWtlcnMgY29tcHV0ZQ0KICAgdGhlIGVmZmVjdGl2ZSBsZW5ndGggb2Yg dGhlIEFTIHBhdGggYnkgc3VtbWluZyB0aGUgcENvdW50IHZhbHVlcyBpbg0KICAgdGhlIEJHUHNl Y19QYXRoIGF0dHJpYnV0ZSwgc2VlIFNlY3Rpb24gNS4pICBIb3dldmVyLCB3aGVuIGEgcm91dGUN CiAgIHNlcnZlciBzZXRzIHRoZSBwQ291bnQgdmFsdWUgdG8gMCwgaXQgc3RpbGwgaW5zZXJ0cyBp dHMgQVMgbnVtYmVyDQogICBpbnRvIHRoZSBTZWN1cmVfUGF0aCBzZWdtZW50LCBhcyB0aGlzIGlu Zm9ybWF0aW9uIGlzIG5lZWRlZCB0bw0KICAgdmFsaWRhdGUgdGhlIHNpZ25hdHVyZSBhZGRlZCBi eSB0aGUgcm91dGUgc2VydmVyLiAoU2VlIFsxOF0gZm9yIGENCiAgIGRpc2N1c3Npb24gb2Ygc2V0 dGluZyBwQ291bnQgdG8gMCB0byBmYWNpbGl0YXRlIEFTIE51bWJlciBNaWdyYXRpb24uKQ0KICAg QkdQc2VjIHNwZWFrZXJzIFNIT1VMRCBkcm9wIGluY29taW5nIHVwZGF0ZSBtZXNzYWdlcyB3aXRo IHBDb3VudCBzZXQNCiAgIHRvIHplcm8gaW4gY2FzZXMgd2hlcmUgdGhlIEJHUHNlYyBzcGVha2Vy IGRvZXMgbm90IGV4cGVjdCBpdHMgcGVlciB0bw0KICAgc2V0IHBDb3VudCB0byB6ZXJvLiAoVGhh dCBpcywgcENvdW50IGlzIG9ubHkgdG8gYmUgc2V0IHRvIHplcm8gaW4NCiAgIGNhc2VzIHN1Y2gg YXMgcm91dGUgc2VydmVycyBvciBBUyBOdW1iZXIgTWlncmF0aW9uIHdoZXJlIHRoZSBCR1BzZWMN CiAgIHNwZWFrZXIncyBwZWVyIGV4cGVjdHMgcENvdW50IHRvIGJlIHNldCB0byB6ZXJvLikNCg0K ICAgTmV4dCwgdGhlIEJHUHNlYyBzcGVha2VyIGdlbmVyYXRlcyBvbmUgb3IgdHdvIFNpZ25hdHVy ZV9CbG9ja3MuDQogICBUeXBpY2FsbHksIGEgQkdQc2VjIHNwZWFrZXIgd2lsbCB1c2Ugb25seSBh IHNpbmdsZSBhbGdvcml0aG0gc3VpdGUsDQogICBhbmQgdGh1cyBjcmVhdGUgb25seSBhIHNpbmds ZSBTaWduYXR1cmVfQmxvY2sgaW4gdGhlIEJHUHNlY19QYXRoDQogICBhdHRyaWJ1dGUuICBIb3dl dmVyLCB0byBlbnN1cmUgYmFja3dhcmRzIGNvbXBhdGliaWxpdHkgZHVyaW5nIGENCiAgIHBlcmlv ZCBvZiB0cmFuc2l0aW9uIGZyb20gYSAnY3VycmVudCcgYWxnb3JpdGhtIHN1aXRlIHRvIGEgJ25l dycNCiAgIGFsZ29yaXRobSBzdWl0ZSwgaXQgd2lsbCBiZSBuZWNlc3NhcnkgdG8gb3JpZ2luYXRl IHVwZGF0ZSBtZXNzYWdlcw0KICAgdGhhdCBjb250YWluIGEgU2lnbmF0dXJlX0Jsb2NrIGZvciBi b3RoIHRoZSAnY3VycmVudCcgYW5kIHRoZSAnbmV3Jw0KICAgYWxnb3JpdGhtIHN1aXRlcyAoc2Vl IFNlY3Rpb24gNi4xKS4NCg0KICAgSWYgdGhlIHJlY2VpdmVkIEJHUHNlYyB1cGRhdGUgbWVzc2Fn ZSBjb250YWlucyB0d28gU2lnbmF0dXJlXyBCbG9ja3MNCiAgIGFuZCB0aGUgQkdQc2VjIHNwZWFr ZXIgc3VwcG9ydHMgYm90aCBvZiB0aGUgY29ycmVzcG9uZGluZyBhbGdvcml0aG1zDQogICBzdWl0 ZXMsIHRoZW4gdGhlIG5ldyB1cGRhdGUgbWVzc2FnZSBnZW5lcmF0ZWQgYnkgdGhlIEJHUHNlYyBz cGVha2VyDQogICBTSE9VTEQgaW5jbHVkZSBib3RoIG9mIHRoZSBTaWduYXR1cmVfQmxvY2tzLiAg SWYgdGhlIHJlY2VpdmVkIEJHUHNlYw0KIA0KDQoNCkxlcGluc2tpICAgICAgICAgICAgICAgICAg RXhwaXJlcyBNYXkgNiwgMjAxNiAgICAgICAgICAgICAgICAgIFtQYWdlIDEzXQ0KDA0KSW50ZXJu ZXQtRHJhZnQgICAgICAgICAgICAgIEJHUHNlYyBQcm90b2NvbCAgICAgICAgICAgICBEZWNlbWJl ciA2LCAyMDE1DQoNCg0KICAgdXBkYXRlIG1lc3NhZ2UgY29udGFpbnMgdHdvIFNpZ25hdHVyZV9C bG9ja3MgYW5kIHRoZSBCR1BzZWMgc3BlYWtlcg0KICAgb25seSBzdXBwb3J0cyBvbmUgb2YgdGhl IHR3byBjb3JyZXNwb25kaW5nIGFsZ29yaXRobSBzdWl0ZXMsIHRoZW4gdGhlDQogICBCR1BzZWMg c3BlYWtlciBNVVNUIHJlbW92ZSB0aGUgU2lnbmF0dXJlX0Jsb2NrIGNvcnJlc3BvbmRpbmcgdG8g dGhlDQogICBhbGdvcml0aG0gc3VpdGUgdGhhdCBpdCBkb2VzIG5vdCB1bmRlcnN0YW5kLiAgSWYg dGhlIEJHUHNlYyBzcGVha2VyDQogICBkb2VzIG5vdCBzdXBwb3J0IHRoZSBhbGdvcml0aG0gc3Vp dGVzIGluIGFueSBvZiB0aGUgU2lnbmF0dXJlX0Jsb2Nrcw0KICAgY29udGFpbmVkIGluIHRoZSBy ZWNlaXZlZCB1cGRhdGUgbWVzc2FnZSwgdGhlbiB0aGUgQkdQc2VjIHNwZWFrZXINCiAgIE1VU1Qg Tk9UIHByb3BhZ2F0ZSB0aGUgcm91dGUgYWR2ZXJ0aXNlbWVudCB3aXRoIHRoZSBCR1BzZWNfUGF0 aA0KICAgYXR0cmlidXRlLiAgKFRoYXQgaXMsIGlmIGl0IGNob29zZXMgdG8gcHJvcGFnYXRlIHRo aXMgcm91dGUNCiAgIGFkdmVydGlzZW1lbnQgYXQgYWxsLCBpdCBtdXN0IGRvIHNvIGFzIGFuIHVu c2lnbmVkIEJHUCB1cGRhdGUNCiAgIG1lc3NhZ2UpLg0KDQogICBOb3RlIHRoYXQgaW4gdGhlIGNh c2Ugd2hlcmUgdGhlIEJHUHNlY19QYXRoIGhhcyB0d28gU2lnbmF0dXJlX0Jsb2Nrcw0KICAgKGNv cnJlc3BvbmRpbmcgdG8gZGlmZmVyZW50IGFsZ29yaXRobSBzdWl0ZXMpLCB0aGUgdmFsaWRhdGlv bg0KICAgYWxnb3JpdGhtIChzZWUgU2VjdGlvbiA1LjIpIGRlZW1zIGEgQkdQc2VjIHVwZGF0ZSBt ZXNzYWdlIHRvIGJlDQogICAnVmFsaWQnIGlmIHRoZXJlIGlzIGF0IGxlYXN0IG9uZSBzdXBwb3J0 ZWQgYWxnb3JpdGhtIHN1aXRlIChhbmQNCiAgIGNvcnJlc3BvbmRpbmcgU2lnbmF0dXJlX0Jsb2Nr KSB0aGF0IGlzIGRlZW1lZCAnVmFsaWQnLiAgVGhpcyBtZWFucw0KICAgdGhhdCBhICdWYWxpZCcg QkdQc2VjIHVwZGF0ZSBtZXNzYWdlIG1heSBjb250YWluIGEgU2lnbmF0dXJlX0Jsb2NrDQogICB3 aGljaCBpcyBub3QgZGVlbWVkICdWYWxpZCcgKGUuZy4sIGNvbnRhaW5zIHNpZ25hdHVyZXMgdGhh dCB0aGUNCiAgIEJHUHNlYyBkb2VzIG5vdCBzdWNjZXNzZnVsbHkgdmVyaWZ5KS4gIE5vbmV0aGVs ZXNzLCBzdWNoDQogICBTaWduYXR1cmVfQmxvY2tzIE1VU1QgTk9UIGJlIHJlbW92ZWQuICAoU2Vl IFNlY3Rpb24gNyBmb3IgYQ0KICAgZGlzY3Vzc2lvbiBvZiB0aGUgc2VjdXJpdHkgcmFtaWZpY2F0 aW9ucyBvZiB0aGlzIGRlc2lnbiBjaG9pY2UuKQ0KDQogICBGb3IgZWFjaCBTaWduYXR1cmVfQmxv Y2sgY29ycmVzcG9uZGluZyB0byBhbiBhbGdvcml0aG0gc3VpdGUgdGhhdCB0aGUNCiAgIEJHUHNl YyBzcGVha2VyIGRvZXMgc3VwcG9ydCwgdGhlIEJHUHNlYyBzcGVha2VyIGFkZHMgYSBuZXcgU2ln bmF0dXJlDQogICBTZWdtZW50IHRvIHRoZSBTaWduYXR1cmVfQmxvY2suICBUaGlzIFNpZ25hdHVy ZSBTZWdtZW50IGlzIHByZXBlbmRlZA0KICAgdG8gdGhlIGxpc3Qgb2YgU2lnbmF0dXJlIFNlZ21l bnRzIChwbGFjZWQgaW4gdGhlIGZpcnN0IHBvc2l0aW9uKSBzbw0KICAgdGhhdCB0aGUgbGlzdCBv ZiBTaWduYXR1cmUgU2VnbWVudHMgYXBwZWFyIGluIHRoZSBzYW1lIG9yZGVyIGFzIHRoZQ0KICAg Y29ycmVzcG9uZGluZyBTZWN1cmVfUGF0aCBzZWdtZW50cy4gIFRoZSBCR1BzZWMgc3BlYWtlciBw b3B1bGF0ZXMgdGhlDQogICBmaWVsZHMgb2YgdGhpcyBuZXcgc2lnbmF0dXJlIHNlZ21lbnQgYXMg Zm9sbG93cy4NCg0KICAgVGhlIFN1YmplY3QgS2V5IElkZW50aWZpZXIgZmllbGQgaW4gdGhlIG5l dyBzZWdtZW50IGlzIHBvcHVsYXRlZCB3aXRoDQogICB0aGUgaWRlbnRpZmllciBjb250YWluZWQg aW4gdGhlIFN1YmplY3QgS2V5IElkZW50aWZpZXIgZXh0ZW5zaW9uIG9mDQogICB0aGUgUlBLSSBy b3V0ZXIgY2VydGlmaWNhdGUgY29ycmVzcG9uZGluZyB0byB0aGUgQkdQc2VjIHNwZWFrZXIgWzld Lg0KICAgVGhpcyBTdWJqZWN0IEtleSBJZGVudGlmaWVyIHdpbGwgYmUgdXNlZCBieSByZWNpcGll bnRzIG9mIHRoZSByb3V0ZQ0KICAgYWR2ZXJ0aXNlbWVudCB0byBpZGVudGlmeSB0aGUgcHJvcGVy IGNlcnRpZmljYXRlIHRvIHVzZSBpbiB2ZXJpZnlpbmcNCiAgIHRoZSBzaWduYXR1cmUuDQoNCiAg IFRoZSBTaWduYXR1cmUgZmllbGQgaW4gdGhlIG5ldyBzZWdtZW50IGNvbnRhaW5zIGEgZGlnaXRh bCBzaWduYXR1cmUNCiAgIHRoYXQgYmluZHMgdGhlIE5MUkkgYW5kIEJHUHNlY19QYXRoIGF0dHJp YnV0ZSB0byB0aGUgUlBLSSByb3V0ZXINCiAgIGNlcnRpZmljYXRlIGNvcnJlc3BvbmRpbmcgdG8g dGhlIEJHUHNlYyBzcGVha2VyLiAgVGhlIGRpZ2l0YWwNCiAgIHNpZ25hdHVyZSBpcyBjb21wdXRl ZCBhcyBmb2xsb3dzOg0KDQogICBvICBDb25zdHJ1Y3QgYSBzZXF1ZW5jZSBvZiBvY3RldHMgYnkg Y29uY2F0ZW5hdGluZyB0aGUgVGFyZ2V0IEFTDQogICAgICBOdW1iZXIsIGFuZCB0aGUgbmV3bHkt Y3JlYXRlZCBTZWN1cmVfUGF0aCBTZWdtZW50IChPcmlnaW4gQVMsDQogICAgICBwQ291bnQsIGFu ZCBGbGFncykuIE5vdGUgdGhhdCB0aGUgVGFyZ2V0IEFTIE51bWJlciBpcyB0aGUgQVMNCiAgICAg IE51bWJlciBvZiB0aGUgQkdQc2VjIHBlZXIgdG8gd2hvbSB0aGUgbmV3bHktY3JlYXRlZCBVcGRh dGUgbWVzc2FnZQ0KICAgICAgaXMgYmVpbmcgc2VudC4gVGhlbiAoaWYgdGhlIEJHUHNlYyBzcGVh a2VyIGlzIG5vdCB0aGUgb3JpZ2luIEFTKQ0KICAgICAgYXBwZW5kIHRvIHRoaXMgc2VxdWVuY2Ug cHJldmlvdXMgU2VjdXJlX1BhdGggYW5kIHRoZSBwcmV2aW91cw0KIA0KDQoNCkxlcGluc2tpICAg ICAgICAgICAgICAgICAgRXhwaXJlcyBNYXkgNiwgMjAxNiAgICAgICAgICAgICAgICAgIFtQYWdl IDE0XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgIEJHUHNlYyBQcm90b2NvbCAgICAg ICAgICAgICBEZWNlbWJlciA2LCAyMDE1DQoNCg0KICAgICAgU2lnbmF0dXJlX0Jsb2NrIHRoYXQg d2VyZSBwcmVzZW50IG9uIHRoZSByZWNlaXZlZCBVcGRhdGUgbWVzc2FnZS4NCiAgICAgIEZpbmFs bHksIGFwcGVuZCB0aGUgQWRkcmVzcyBGYW1pbHkgSWRlbnRpZmllciAoQUZJKSwgU3Vic2VxdWVu dA0KICAgICAgQWRkcmVzcyBGYW1pbHkgSWRlbnRpZmllciAoU0FGSSksIGFuZCBOZXR3b3JrIExh eWVyIFJlYWNoYWJpbGl0eQ0KICAgICAgSW5mb3JtYXRpb24gKE5MUkkpIGZpZWxkcyBmcm9tIHRo ZSBNUF9SRUFDSF9OTFJJIGF0dHJpYnV0ZS4NCiAgICAgIEFkZGl0aW9uYWxseSwgaW4gdGhlIFBy ZWZpeCBmaWVsZCBvZiB0aGUgTkxSSSAoZnJvbQ0KICAgICAgTVBfUkVBQ0hfTkxSSSksIGFsbCBv ZiB0aGUgdHJhaWxpbmcgYml0cyBNVVNUIGJlIHNldCB0byB6ZXJvIHdoZW4NCiAgICAgIGNvbnN0 cnVjdGluZyB0aGlzIHNlcXVlbmNlLiBJbiB0aGlzIHNlcXVlbmNlLCB0aGUgVGFyZ2V0IEFTIE51 bWJlcg0KICAgICAgaXMgdGhlIEFTIHRvIHdob20gdGhlIEJHUHNlYyBzcGVha2VyIGludGVuZHMg dG8gc2VuZCB0aGUgdXBkYXRlDQogICAgICBtZXNzYWdlLiAgKE5vdGUgdGhhdCB0aGUgVGFyZ2V0 IEFTIG51bWJlciBpcyB0aGUgQVMgbnVtYmVyDQogICAgICBhbm5vdW5jZWQgYnkgdGhlIHBlZXIg aW4gdGhlIE9QRU4gbWVzc2FnZSBvZiB0aGUgQkdQIHNlc3Npb24NCiAgICAgIHdpdGhpbiB3aGlj aCB0aGUgdXBkYXRlIGlzIHNlbnQuKSANCg0KICAgICAgICAgICBTZXF1ZW5jZSBvZiBPY3RldHMg dG8gYmUgU2lnbmVkDQogICAgICAgICstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tKw0KICAgICAgICB8IFRhcmdldCBBUyBOdW1iZXIgICAgICAgICAoNCBvY3RldHMpIHwNCiAg ICAgICAgKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rDQogICAgICAgIHwg QVMgTnVtYmVyICAgICAgICAgICAgICAgICg0IG9jdGV0cykgfCAgDQogICAgICAgICstLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKyAgICANCiAgICAgICAgfCBwQ291bnQgICAg ICAgICAgICAgICAgICAgKDEgb2N0ZXQpICB8ICANCiAgICAgICAgKy0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0rICANCiAgICAgICAgfCBGbGFncyAgICAgICAgICAgICAgICAg ICAgKDEgb2N0ZXQpICB8ICANCiAgICAgICAgKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0rDQogICAgICAgIHwgUHJldmlvdXMgU2VjdXJlX1BhdGggICAgICh2YXJpYWJsZSkg fA0KICAgICAgICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsNCiAgICAg ICAgfCBQcmV2aW91cyBTaWduYXR1cmVfQmxvY2sgKHZhcmlhYmxlKSB8DQogICAgICAgICstLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKw0KICAgICAgICB8IEFGSSAgICAgICAg ICAgICAgICAgICAgICAoMiBvY3RldHMpIHwgIC0tLVwNCiAgICAgICAgKy0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rICAgICAgXA0KICAgICAgICB8IFNBRkkgICAgICAgICAg ICAgICAgICAgICAoMSBvY3RldCkgIHwgICAgICAgPiAgTVBfUkVBQ0hfTkxSSQ0KICAgICAgICAr LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsgICAgICAvDQogICAgICAgIHwg TkxSSSAgICAgICAgICAgICAgICAgICAgICh2YXJpYWJsZSkgfCAgLS0tLw0KICAgICAgICArLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsNCg0KICAgbyAgQXBwbHkgdG8gdGhp cyBvY3RldCBzZXF1ZW5jZSB0aGUgZGlnZXN0IGFsZ29yaXRobSAoZm9yIHRoZQ0KICAgICAgYWxn b3JpdGhtIHN1aXRlIG9mIHRoaXMgU2lnbmF0dXJlX0Jsb2NrKSB0byBvYnRhaW4gYSBkaWdlc3Qg dmFsdWUuDQoNCiAgIG8gIEFwcGx5IHRvIHRoaXMgZGlnZXN0IHZhbHVlIHRoZSBzaWduYXR1cmUg YWxnb3JpdGhtLCAoZm9yIHRoZQ0KICAgICAgYWxnb3JpdGhtIHN1aXRlIG9mIHRoaXMgU2lnbmF0 dXJlX0Jsb2NrKSB0byBvYnRhaW4gdGhlIGRpZ2l0YWwNCiAgICAgIHNpZ25hdHVyZS4gIFRoZW4g cG9wdWxhdGUgdGhlIFNpZ25hdHVyZSBGaWVsZCB3aXRoIHRoaXMgZGlnaXRhbA0KICAgICAgc2ln bmF0dXJlLg0KDQogICBUaGUgU2lnbmF0dXJlIExlbmd0aCBmaWVsZCBpcyBwb3B1bGF0ZWQgd2l0 aCB0aGUgbGVuZ3RoIChpbiBvY3RldHMpDQogICBvZiB0aGUgU2lnbmF0dXJlIGZpZWxkLg0KDQo0 LjMuICBQcm9jZXNzaW5nIEluc3RydWN0aW9ucyBmb3IgQ29uZmVkZXJhdGlvbiBNZW1iZXJzDQoN CiAgIE1lbWJlcnMgb2YgYXV0b25vbW91cyBzeXN0ZW0gY29uZmVkZXJhdGlvbnMgWzVdIE1VU1Qg YWRkaXRpb25hbGx5DQogICBmb2xsb3cgdGhlIGluc3RydWN0aW9ucyBpbiB0aGlzIHNlY3Rpb24g Zm9yIHByb2Nlc3NpbmcgQkdQc2VjIHVwZGF0ZQ0KIA0KDQoNCkxlcGluc2tpICAgICAgICAgICAg ICAgICAgRXhwaXJlcyBNYXkgNiwgMjAxNiAgICAgICAgICAgICAgICAgIFtQYWdlIDE1XQ0KDA0K SW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgIEJHUHNlYyBQcm90b2NvbCAgICAgICAgICAgICBE ZWNlbWJlciA2LCAyMDE1DQoNCg0KICAgbWVzc2FnZXMuDQoNCiAgIFdoZW4gYSBjb25mZWRlcmF0 aW9uIG1lbWJlciBzZW5kcyBhIEJHUHNlYyB1cGRhdGUgbWVzc2FnZSB0byBhIHBlZXINCiAgIHRo YXQgaXMgYSBtZW1iZXIgb2YgdGhlIHNhbWUgY29uZmVkZXJhdGlvbiwgdGhlIGNvbmZlZGVyYXRp b24gbWVtYmVyDQogICBwdXRzIGl0cyAocHJpdmF0ZSkgTWVtYmVyLUFTIE51bWJlciAoYXMgb3Bw b3NlZCB0byB0aGUgcHVibGljIEFTDQogICBDb25mZWRlcmF0aW9uIElkZW50aWZpZXIpIGluIHRo ZSBBUyBOdW1iZXIgZmllbGQgb2YgdGhlIFNlY3VyZV9QYXRoDQogICBTZWdtZW50IHRoYXQgaXQg YWRkcyB0byB0aGUgQkdQc2VjIHVwZGF0ZSBtZXNzYWdlLiAgRnVydGhlcm1vcmUsIHdoZW4NCiAg IGEgY29uZmVkZXJhdGlvbiBtZW1iZXIgc2VuZHMgYSBCR1BzZWMgdXBkYXRlIG1lc3NhZ2UgdG8g YSBwZWVyIHRoYXQNCiAgIGlzIGEgbWVtYmVyIG9mIHRoZSBzYW1lIGNvbmZlZGVyYXRpb24sIHRo ZSBCR1BzZWMgc3BlYWtlciB0aGF0DQogICBnZW5lcmF0ZXMgdGhlIFNlY3VyZV9QYXRoIFNlZ21l bnQgc2V0cyB0aGUgQ29uZmVkX1NlZ21lbnQgZmxhZyB0bw0KICAgb25lLiAgVGhpcyBtZWFucyB0 aGF0IGluIGEgQkdQc2VjIHVwZGF0ZSBtZXNzYWdlLCBhbiBBUyBudW1iZXINCiAgIGFwcGVhcnMg aW4gYSBTZWN1cmVfUGF0aCBTZWdtZW50IHdpdGggdGhlIENvbmZlZF9TZWdtZW50IGZsYWcgc2V0 DQogICB3aGVuZXZlciwgaW4gYSBub24tQkdQc2VjIHVwZGF0ZSBtZXNzYWdlLCB0aGUgQVMgbnVt YmVyIHdvdWxkIGFwcGVhcg0KICAgaW4gYSBzZWdtZW50IG9mIHR5cGUgQVNfQ09ORkVEX1NFUVVF TkNFIGluIGEgbm9uLUJHUHNlYyB1cGRhdGUNCiAgIG1lc3NhZ2UuDQoNCiAgIFdpdGhpbiBhIGNv bmZlZGVyYXRpb24sIHRoZSB2ZXJpZmljYXRpb24gb2YgQkdQc2VjIHNpZ25hdHVyZXMgYWRkZWQN CiAgIGJ5IG90aGVyIG1lbWJlcnMgb2YgdGhlIGNvbmZlZGVyYXRpb24gaXMgb3B0aW9uYWwuICBJ ZiBhDQogICBjb25mZWRlcmF0aW9uIGNob29zZXMgbm90IHRvIGhhdmUgaXRzIG1lbWJlcnMgdmVy aWZ5IHNpZ25hdHVyZXMgYWRkZWQNCiAgIGJ5IG90aGVyIGNvbmZlZGVyYXRpb24gbWVtYmVycywg dGhlbiB3aGVuIHNlbmRpbmcgYSBCR1BzZWMgdXBkYXRlDQogICBtZXNzYWdlIHRvIGEgcGVlciB0 aGF0IGlzIGEgbWVtYmVyIG9mIHRoZSBzYW1lIGNvbmZlZGVyYXRpb24sIHRoZQ0KICAgY29uZmVk ZXJhdGlvbiBtZW1iZXJzIE1BWSBzZXQgdGhlIFNpZ25hdHVyZSBmaWVsZCB3aXRoaW4gdGhlDQog ICBTaWduYXR1cmUgU2VnbWVudCB0aGF0IGl0IGdlbmVyYXRlcyB0byBiZSB6ZXJvIChpbiBsaWV1 IG9mDQogICBjYWxjdWxhdGluZyB0aGUgY29ycmVjdCBkaWdpdGFsIHNpZ25hdHVyZSBhcyBkZXNj cmliZWQgaW4gU2VjdGlvbnMNCiAgIDQuMSBhbmQgNC4yKS4gIE5vdGUgdGhhdCBpZiBhIGNvbmZl ZGVyYXRpb24gY2hvb3NlcyBub3QgdG8gdmVyaWZ5DQogICBkaWdpdGFsIHNpZ25hdHVyZXMgd2l0 aGluIHRoZSBjb25mZWRlcmF0aW9uLCB0aGVuIEJHUHNlYyBpcyBhYmxlIHRvDQogICBwcm92aWRl IG5vIGFzc3VyYW5jZXMgYWJvdXQgdGhlIGludGVncml0eSBvZiB0aGUgKHByaXZhdGUpIE1lbWJl ci1BUw0KICAgTnVtYmVycyBwbGFjZWQgaW4gU2VjdXJlX1BhdGggc2VnbWVudHMgd2hlcmUgdGhl IENvbmZlZF9TZWdtZW50IGZsYWcNCiAgIGlzIHNldCB0byBvbmUuDQoNCiAgIFdoZW4gYSBjb25m ZWRlcmF0aW9uIG1lbWJlciByZWNlaXZlcyBhIEJHUHNlYyB1cGRhdGUgbWVzc2FnZSBmcm9tIGEN CiAgIHBlZXIgd2l0aGluIHRoZSBjb25mZWRlcmF0aW9uIGFuZCBwcm9wYWdhdGVzIGl0IHRvIGEg cGVlciBvdXRzaWRlIHRoZQ0KICAgY29uZmVkZXJhdGlvbiwgaXQgbmVlZHMgdG8gcmVtb3ZlIGFs bCBvZiB0aGUgU2VjdXJlX1BhdGggU2VnbWVudHMNCiAgIGFkZGVkIGJ5IGNvbmZlZGVyYXRpb24g bWVtYmVycyBhcyB3ZWxsIGFzIHRoZSBjb3JyZXNwb25kaW5nIFNpZ25hdHVyZQ0KICAgU2VnbWVu dHMuICBUbyBkbyB0aGlzLCB0aGUgY29uZmVkZXJhdGlvbiBtZW1iZXIgcHJvcGFnYXRpbmcgdGhl IHJvdXRlDQogICBvdXRzaWRlIHRoZSBjb25mZWRlcmF0aW9uIGRvZXMgdGhlIGZvbGxvd2luZzoN Cg0KICAgbyAgRmlyc3QsIHN0YXJ0aW5nIHdpdGggdGhlIG1vc3QgcmVjZW50bHkgYWRkZWQgU2Vj dXJlX1BhdGggc2VnbWVudCwNCiAgICAgIHJlbW92ZSBhbGwgb2YgdGhlIGNvbnNlY3V0aXZlIFNl Y3VyZV9QYXRoIHNlZ21lbnRzIHRoYXQgaGF2ZSB0aGUNCiAgICAgIENvbmZlZF9TZWdtZW50IGZs YWcgc2V0IHRvIG9uZS4gIFN0b3AgdGhpcyBwcm9jZXNzIG9uY2UgYQ0KICAgICAgU2VjdXJlX1Bh dGggc2VnbWVudCBpcyByZWFjaGVkIHdoaWNoIGhhcyBpdHMgQ29uZmVkX1NlZ21lbnQgZmxhZw0K ICAgICAgc2V0IHRvIHplcm8uICBLZWVwIGEgY291bnQgb2YgdGhlIG51bWJlciBvZiBzZWdtZW50 cyByZW1vdmVkIGluDQogICAgICB0aGlzIGZhc2hpb24uDQoNCg0KICAgbyAgU2Vjb25kLCBzdGFy dGluZyB3aXRoIHRoZSBtb3N0IHJlY2VudGx5IGFkZGVkIFNpZ25hdHVyZSBTZWdtZW50LA0KICAg ICAgcmVtb3ZlIGEgbnVtYmVyIG9mIFNpZ25hdHVyZSBTZWdtZW50cyBlcXVhbCB0byB0aGUgbnVt YmVyIG9mDQogICAgICBTZWN1cmVfUGF0aCBTZWdtZW50cyByZW1vdmVkIGluIHRoZSBwcmV2aW91 cyBzdGVwLiAgKFRoYXQgaXMsDQogDQoNCg0KTGVwaW5za2kgICAgICAgICAgICAgICAgICBFeHBp cmVzIE1heSA2LCAyMDE2ICAgICAgICAgICAgICAgICAgW1BhZ2UgMTZdDQoMDQpJbnRlcm5ldC1E cmFmdCAgICAgICAgICAgICAgQkdQc2VjIFByb3RvY29sICAgICAgICAgICAgIERlY2VtYmVyIDYs IDIwMTUNCg0KDQogICAgICByZW1vdmUgdGhlIEsgbW9zdCByZWNlbnRseSBhZGRlZCBzaWduYXR1 cmUgc2VnbWVudHMsIHdoZXJlIEsgaXMNCiAgICAgIHRoZSBudW1iZXIgb2YgU2VjdXJlX1BhdGgg U2VnbWVudHMgcmVtb3ZlZCBpbiB0aGUgcHJldmlvdXMgc3RlcC4pDQoNCiAgIG8gIEZpbmFsbHks IGFkZCBhIFNlY3VyZV9QYXRoIFNlZ21lbnQgY29udGFpbmluZywgaW4gdGhlIEFTIGZpZWxkLA0K ICAgICAgdGhlIEFTIENvbmZlZGVyYXRpb24gSWRlbnRpZmllciAodGhlIHB1YmxpYyBBUyBudW1i ZXIgb2YgdGhlDQogICAgICBjb25mZWRlcmF0aW9uKSBhcyB3ZWxsIGFzIGEgY29ycmVzcG9uZGlu ZyBTaWduYXR1cmUgU2VnbWVudC4gIE5vdGUNCiAgICAgIHRoYXQgYWxsIGZpZWxkcyBvdGhlciB0 aGF0IHRoZSBBUyBmaWVsZCBhcmUgcG9wdWxhdGVkIGFzIHBlcg0KICAgICAgU2VjdGlvbnMgNC4x IGFuZCA0LjIuDQoNCiAgIFdoZW4gdmFsaWRhdGluZyBhIHJlY2VpdmVkIEJHUHNlYyB1cGRhdGUg bWVzc2FnZSwgY29uZmVkZXJhdGlvbg0KICAgbWVtYmVycyBuZWVkIHRvIG1ha2UgdGhlIGZvbGxv d2luZyBhZGp1c3RtZW50IHRvIHRoZSBhbGdvcml0aG0NCiAgIHByZXNlbnRlZCBpbiBTZWN0aW9u IDUuMi4gIFdoZW4gYSBjb25mZWRlcmF0aW9uIG1lbWJlciBwcm9jZXNzZXMNCiAgICh2YWxpZGF0 ZXMpIGEgU2lnbmF0dXJlIFNlZ21lbnQgYW5kIGl0cyBjb3JyZXNwb25kaW5nIFNlY3VyZV9QYXRo DQogICBTZWdtZW50LCB0aGUgY29uZmVkZXJhdGlvbiBtZW1iZXIgbXVzdCBub3RlIHRoZSBmb2xs b3dpbmcuIEZvciBhDQogICBzaWduYXR1cmUgcHJvZHVjZWQgYnkgYSBwZWVyIEJHUHNlYyBzcGVh a2VyIG91dHNpZGUgb2YgYQ0KICAgY29uZmVkZXJhdGlvbiwgdGhlIFRhcmdldCBBUyB3aWxsIGFs d2F5cyBiZSB0aGUgQVMgQ29uZmVkZXJhdGlvbg0KICAgSWRlbnRpZmllciAodGhlIHB1YmxpYyBB UyBudW1iZXIgb2YgdGhlIGNvbmZlZGVyYXRpb24pIGFzIG9wcG9zZWQgdG8NCiAgIHRoZSBNZW1i ZXItQVMgTnVtYmVyLg0KDQogICBUbyBoYW5kbGUgdGhpcyBjYXNlLCB3aGVuIGEgQkdQc2VjIHNw ZWFrZXIgKHRoYXQgaXMgYSBjb25mZWRlcmF0aW9uDQogICBtZW1iZXIpIHByb2Nlc3NlcyBhIGN1 cnJlbnQgU2VjdXJlX1BhdGggU2VnbWVudCB0aGF0IGhhcyB0aGUNCiAgIENvbmZlZF9TZWdtZW50 IGZsYWcgc2V0IHRvIHplcm8sIGlmIHRoZSBuZXh0IG1vc3QgcmVjZW50bHkgYWRkZWQNCiAgIFNl Y3VyZV9QYXRoIHNlZ21lbnQgaGFzIHRoZSBDb25mZWRfU2VnbWVudCBmbGFnIHNldCB0byBvbmUg dGhlbiwgd2hlbg0KICAgY29tcHV0aW5nIHRoZSBkaWdlc3QgZm9yIHRoZSBjdXJyZW50IFNlY3Vy ZV9QYXRoIHNlZ21lbnQsIHRoZSBCR1BzZWMNCiAgIHNwZWFrZXIgdGFrZXMgdGhlIFRhcmdldCBB UyBOdW1iZXIgdG8gYmUgdGhlIEFTIENvbmZlZGVyYXRpb24NCiAgIElkZW50aWZpZXIgb2YgdGhl IHZhbGlkYXRpbmcgQkdQc2VjIHNwZWFrZXIncyBvd24gY29uZmVkZXJhdGlvbi4NCiAgIChOb3Rl IHRoYXQgdGhlIGFsZ29yaXRobSBpbiBTZWN0aW9uIDUuMiBwcm9jZXNzZXMgU2VjdXJlX1BhdGgN CiAgIFNlZ21lbnRzIGluIG9yZGVyIGZyb20gbW9zdCByZWNlbnRseSBhZGRlZCB0byBsZWFzdCBy ZWNlbnRseSBhZGRlZCwNCiAgIHRoZXJlZm9yZSB0aGlzIHNwZWNpYWwgY2FzZSB3aWxsIGFwcGx5 IHRvIHRoZSBmaXJzdCBTZWN1cmVfUGF0aA0KICAgc2VnbWVudCB0aGF0IHRoZSBhbGdvcml0aG0g ZW5jb3VudGVycyB0aGF0IGhhcyB0aGUgQ29uZmVkX1NlZ21lbnQNCiAgIGZsYWcgc2V0IHRvIHpl cm8uKQ0KDQogICBGaW5hbGx5LCBhcyBkaXNjdXNzZWQgYWJvdmUsIGFuIEFTIGNvbmZlZGVyYXRp b24gbWF5IG9wdGlvbmFsbHkNCiAgIGRlY2lkZSB0aGF0IGl0cyBtZW1iZXJzIHdpbGwgbm90IHZl cmlmeSBkaWdpdGFsIHNpZ25hdHVyZXMgYWRkZWQgYnkNCiAgIG1lbWJlcnMuICBJbiBzdWNoIGEg ZmVkZXJhdGlvbiwgd2hlbiBhIGNvbmZlZGVyYXRpb24gbWVtYmVyIHJ1bnMgdGhlDQogICBhbGdv cml0aG0gaW4gU2VjdGlvbiA1LjIsIHRoZSBjb25mZWRlcmF0aW9uIG1lbWJlciwgZHVyaW5nIHBy b2Nlc3NpbmcNCiAgIG9mIGEgU2lnbmF0dXJlIFNlZ21lbnQsIGZpcnN0IGNoZWNrcyB3aGV0aGVy IHRoZSBDb25mZWRfU2VxdWVuY2UgZmxhZw0KICAgaW4gdGhlIGNvcnJlc3BvbmRpbmcgU2VjdXJl X1BhdGggc2VnbWVudCBpcyBzZXQgdG8gb25lLiAgSWYgdGhlDQogICBDb25mZWRfU2VxdWVuY2Ug ZmxhZyBpcyBzZXQgdG8gb25lIGluIHRoZSBjb3JyZXNwb25kaW5nIFNlY3VyZV9QYXRoDQogICBz ZWdtZW50LCB0aGUgY29uZmVkZXJhdGlvbiBtZW1iZXIgZG9lcyBub3QgcGVyZm9ybSBhbnkgZnVy dGhlciBjaGVja3MNCiAgIG9uIHRoZSBTaWduYXR1cmUgU2VnbWVudCBhbmQgaW1tZWRpYXRlbHkg bW92ZXMgb24gdG8gdGhlIG5leHQNCiAgIFNpZ25hdHVyZSBTZWdtZW50IChhbmQgY2hlY2tzIGl0 cyBjb3JyZXNwb25kaW5nIFNlY3VyZV9QYXRoIHNlZ21lbnQpLg0KICAgTm90ZSB0aGF0IGFzIHNw ZWNpZmllZCBpbiBTZWN0aW9uIDUuMiwgaXQgaXMgYW4gZXJyb3Igd2hlbiBhIEJHUHNlYw0KICAg c3BlYWtlciByZWNlaXZlcyBmcm9tIGEgcGVlciwgd2hvIGlzIG5vdCBpbiB0aGUgc2FtZSBBUw0K ICAgY29uZmVkZXJhdGlvbiwgYSBCR1BzZWMgdXBkYXRlIGNvbnRhaW5pbmcgYSBDb25mZWRfU2Vx dWVuY2UgZmxhZyBzZXQNCiAgIHRvIG9uZS4gIChBcyBkaXNjdXNzZWQgaW4gU2VjdGlvbiA1LjIs IGFueSBlcnJvciBpbiB0aGUgQkdQc2VjX1BhdGgNCiAgIGF0dHJpYnV0ZSBNVVNUIGJlIGhhbmRs ZWQgdXNpbmcgdGhlICJ0cmVhdC1hcy13aXRoZHJhdyIsIGFwcHJvYWNoIGFzDQogICBkZWZpbmVk IGluIFJGQyBXWFlaIFsxMV0uKQ0KIA0KDQoNCkxlcGluc2tpICAgICAgICAgICAgICAgICAgRXhw aXJlcyBNYXkgNiwgMjAxNiAgICAgICAgICAgICAgICAgIFtQYWdlIDE3XQ0KDA0KSW50ZXJuZXQt RHJhZnQgICAgICAgICAgICAgIEJHUHNlYyBQcm90b2NvbCAgICAgICAgICAgICBEZWNlbWJlciA2 LCAyMDE1DQoNCg0KNC40LiAgUmVjb25zdHJ1Y3RpbmcgdGhlIEFTX1BBVEggQXR0cmlidXRlDQoN CiAgIEJHUHNlYyB1cGRhdGUgbWVzc2FnZXMgZG8gbm90IGNvbnRhaW4gdGhlIEFTX1BBVEggYXR0 cmlidXRlLiBIb3dldmVyLA0KICAgdGhlIEFTX1BBVEggYXR0cmlidXRlIGNhbiBiZSByZWNvbnN0 cnVjdGVkIGZyb20gdGhlIEJHUHNlY19QYXRoDQogICBhdHRyaWJ1dGUuICBUaGlzIGlzIG5lY2Vz c2FyeSBpbiB0aGUgY2FzZSB3aGVyZSBhIHJvdXRlIGFkdmVydGlzZW1lbnQNCiAgIGlzIHJlY2Vp dmVkIHZpYSBhIEJHUHNlYyB1cGRhdGUgbWVzc2FnZSBhbmQgdGhlbiBwcm9wYWdhdGVkIHRvIGEg cGVlcg0KICAgdmlhIGEgbm9uLUJHUHNlYyB1cGRhdGUgbWVzc2FnZSAoZS5nLiwgYmVjYXVzZSB0 aGUgbGF0dGVyIHBlZXIgZG9lcw0KICAgbm90IHN1cHBvcnQgQkdQc2VjKS4gTm90ZSB0aGF0IHRo ZXJlIG1heSBiZSBhZGRpdGlvbmFsIGNhc2VzIHdoZXJlIGFuDQogICBpbXBsZW1lbnRhdGlvbiBm aW5kcyBpdCB1c2VmdWwgdG8gcGVyZm9ybSB0aGlzIHJlY29uc3RydWN0aW9uLg0KDQogICBUaGUg QVNfUEFUSCBhdHRyaWJ1dGUgY2FuIGJlIGNvbnN0cnVjdGVkIGZyb20gdGhlIEJHUHNlY19QYXRo DQogICBhdHRyaWJ1dGUgYXMgZm9sbG93cy4gIFN0YXJ0aW5nIHdpdGggYW4gZW1wdHkgQVNfUEFU SCBhdHRyaWJ1dGUsDQogICBwcm9jZXNzIHRoZSBTZWN1cmVfUGF0aCBzZWdtZW50cyBpbiBvcmRl ciBmcm9tIGxlYXN0LXJlY2VudGx5IGFkZGVkDQogICAoY29ycmVzcG9uZGluZyB0byB0aGUgb3Jp Z2luKSB0byBtb3N0LXJlY2VudGx5IGFkZGVkLiAgRm9yIGVhY2gNCiAgIFNlY3VyZV9QYXRoIHNl Z21lbnQgcGVyZm9ybSB0aGUgZm9sbG93aW5nIHN0ZXBzOg0KDQogICAxLiAgSWYgdGhlIENvbmZl ZF9TZWdtZW50IGZsYWcgaW4gdGhlIFNlY3VyZV9QYXRoIHNlZ21lbnQgaXMgc2V0IHRvDQogICAg ICAgb25lLCB0aGVuIGxvb2sgYXQgdGhlIG1vc3QtcmVjZW50bHkgYWRkZWQgc2VnbWVudCBpbiB0 aGUgQVNfUEFUSC4NCg0KICAgICAgICogIEluIHRoZSBjYXNlIHdoZXJlIHRoZSBBU19QQVRIIGlz IGVtcHR5IG9yIGluIHRoZSBjYXNlIHdoZXJlDQogICAgICAgICAgdGhlIG1vc3QtcmVjZW50bHkg YWRkZWQgc2VnbWVudCBpcyBvZiB0eXBlIEFTX1NFUVVFTkNFIHRoZW4NCiAgICAgICAgICBhZGQg KHByZXBlbmQgdG8gdGhlIEFTX1BBVEgpIGEgbmV3IEFTX1BBVEggc2VnbWVudCBvZiB0eXBlDQog ICAgICAgICAgQVNfQ09ORkVEX1NFUVVFTkNFLiAgVGhpcyBzZWdtZW50IG9mIHR5cGUgQVNfQ09O RkVEX1NFUVVFTkNFDQogICAgICAgICAgc2hhbGwgY29udGFpbiBhIG51bWJlciBvZiBlbGVtZW50 cyBlcXVhbCB0byB0aGUgcENvdW50IGZpZWxkDQogICAgICAgICAgaW4gdGhlIGN1cnJlbnQgU2Vj dXJlX1BhdGggc2VnbWVudC4gIEVhY2ggb2YgdGhlc2UgZWxlbWVudHMNCiAgICAgICAgICBzaGFs bCBiZSB0aGUgQVMgbnVtYmVyIGNvbnRhaW5lZCBpbiB0aGUgY3VycmVudCBTZWN1cmVfUGF0aA0K ICAgICAgICAgIHNlZ21lbnQuICAoVGhhdCBpcywgaWYgdGhlIHBDb3VudCBmaWVsZCBpcyBYLCB0 aGVuIHRoZSBzZWdtZW50DQogICAgICAgICAgb2YgdHlwZSBBU19DT05GRURfU0VRVUVOQ0UgY29u dGFpbnMgWCBjb3BpZXMgb2YgdGhlDQogICAgICAgICAgU2VjdXJlX1BhdGggc2VnbWVudCdzIEFT IE51bWJlciBmaWVsZC4pDQoNCiAgICAgICAqICBJbiB0aGUgY2FzZSB3aGVyZSB0aGUgbW9zdC1y ZWNlbnRseSBhZGRlZCBzZWdtZW50IGluIHRoZQ0KICAgICAgICAgIEFTX1BBVEggaXMgb2YgdHlw ZSBBU19DT05GRURfU0VRVUVOQ0UgdGhlbiBhZGQgKHByZXBlbmQgdG8gdGhlDQogICAgICAgICAg c2VnbWVudCkgYSBudW1iZXIgb2YgZWxlbWVudHMgZXF1YWwgdG8gdGhlIHBDb3VudCBmaWVsZCBp biB0aGUNCiAgICAgICAgICBjdXJyZW50IFNlY3VyZV9QYXRoIHNlZ21lbnQuICBUaGUgdmFsdWUg b2YgZWFjaCBvZiB0aGVzZQ0KICAgICAgICAgIGVsZW1lbnRzIHNoYWxsIGJlIHRoZSBBUyBudW1i ZXIgY29udGFpbmVkIGluIHRoZSBjdXJyZW50DQogICAgICAgICAgU2VjdXJlX1BhdGggc2VnbWVu dC4gIChUaGF0IGlzLCBpZiB0aGUgcENvdW50IGZpZWxkIGlzIFgsIHRoZW4NCiAgICAgICAgICBh ZGQgWCBjb3BpZXMgb2YgdGhlIFNlY3VyZV9QYXRoIHNlZ21lbnQncyBBUyBOdW1iZXIgZmllbGQg dG8NCiAgICAgICAgICB0aGUgZXhpc3RpbmcgQVNfQ09ORkVEX1NFUVVFTkNFLikNCg0KICAgMi4g IElmIHRoZSBDb25mZWRfU2VnbWVudCBmbGFnIGluIHRoZSBTZWN1cmVfUGF0aCBzZWdtZW50IGlz IHNldCB0bw0KICAgICAgIHplcm8sIHRoZW4gbG9vayBhdCB0aGUgbW9zdC1yZWNlbnRseSBhZGRl ZCBzZWdtZW50IGluIHRoZQ0KICAgICAgIEFTX1BBVEguDQoNCiAgICAgICAqICBJbiB0aGUgY2Fz ZSB3aGVyZSB0aGUgQVNfUEFUSCBpcyBlbXB0eSwgYW5kIHRoZSBwQ291bnQgZmllbGQNCiAgICAg ICAgICBpbiB0aGUgU2VjdXJlX1BhdGggc2VnbWVudCBpcyBncmVhdGVyIHRoYW4gemVybywgYWRk IChwcmVwZW5kDQogICAgICAgICAgdG8gdGhlIEFTX1BBVEgpIGEgbmV3IEFTX1BBVEggc2VnbWVu dCBvZiB0eXBlIEFTX1NFUVVFTkNFLg0KICAgICAgICAgIFRoaXMgc2VnbWVudCBvZiB0eXBlIEFT X1NFUVVFTkNFIHNoYWxsIGNvbnRhaW4gYSBudW1iZXIgb2YNCiAgICAgICAgICBlbGVtZW50cyBl cXVhbCB0byB0aGUgcENvdW50IGZpZWxkIGluIHRoZSBjdXJyZW50IFNlY3VyZV9QYXRoDQogDQoN Cg0KTGVwaW5za2kgICAgICAgICAgICAgICAgICBFeHBpcmVzIE1heSA2LCAyMDE2ICAgICAgICAg ICAgICAgICAgW1BhZ2UgMThdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgQkdQc2Vj IFByb3RvY29sICAgICAgICAgICAgIERlY2VtYmVyIDYsIDIwMTUNCg0KDQogICAgICAgICAgc2Vn bWVudC4gIEVhY2ggb2YgdGhlc2UgZWxlbWVudHMgc2hhbGwgYmUgdGhlIEFTIG51bWJlcg0KICAg ICAgICAgIGNvbnRhaW5lZCBpbiB0aGUgY3VycmVudCBTZWN1cmVfUGF0aCBzZWdtZW50LiAgKFRo YXQgaXMsIGlmDQogICAgICAgICAgdGhlIHBDb3VudCBmaWVsZCBpcyBYLCB0aGVuIHRoZSBzZWdt ZW50IG9mIHR5cGUgQVNfU0VRVUVOQ0UNCiAgICAgICAgICBjb250YWlucyBYIGNvcGllcyBvZiB0 aGUgU2VjdXJlX1BhdGggc2VnbWVudCdzIEFTIE51bWJlcg0KICAgICAgICAgIGZpZWxkLikNCg0K ICAgICAgICogIEluIHRoZSBjYXNlIHdoZXJlIHRoZSBtb3N0IHJlY2VudGx5IGFkZGVkIHNlZ21l bnQgaW4gdGhlDQogICAgICAgICAgQVNfUEFUSCBpcyBvZiB0eXBlIEFTX1NFUVVFTkNFIHRoZW4g YWRkIChwcmVwZW5kIHRvIHRoZQ0KICAgICAgICAgIHNlZ21lbnQpIGEgbnVtYmVyIG9mIGVsZW1l bnRzIGVxdWFsIHRvIHRoZSBwQ291bnQgZmllbGQgaW4gdGhlDQogICAgICAgICAgY3VycmVudCBT ZWN1cmVfUGF0aCBzZWdtZW50LiAgVGhlIHZhbHVlIG9mIGVhY2ggb2YgdGhlc2UNCiAgICAgICAg ICBlbGVtZW50cyBzaGFsbCBiZSB0aGUgQVMgbnVtYmVyIGNvbnRhaW5lZCBpbiB0aGUgY3VycmVu dA0KICAgICAgICAgIFNlY3VyZV9QYXRoIHNlZ21lbnQuICAoVGhhdCBpcywgaWYgdGhlIHBDb3Vu dCBmaWVsZCBpcyBYLCB0aGVuDQogICAgICAgICAgYWRkIFggY29waWVzIG9mIHRoZSBTZWN1cmVf UGF0aCBzZWdtZW50J3MgQVMgTnVtYmVyIGZpZWxkIHRvDQogICAgICAgICAgdGhlIGV4aXN0aW5n IEFTX1NFUVVFTkNFLikNCg0KDQo1LiAgUHJvY2Vzc2luZyBhIFJlY2VpdmVkIEJHUHNlYyBVcGRh dGUNCg0KICAgVXBvbiByZWNlaXZpbmcgYSBCR1BzZWMgdXBkYXRlIG1lc3NhZ2UgZnJvbSBhbiBl eHRlcm5hbCAoZUJHUCkgcGVlciwNCiAgIGEgQkdQc2VjIHNwZWFrZXIgU0hPVUxEIHZhbGlkYXRl IHRoZSBtZXNzYWdlIHRvIGRldGVybWluZSB0aGUNCiAgIGF1dGhlbnRpY2l0eSBvZiB0aGUgcGF0 aCBpbmZvcm1hdGlvbiBjb250YWluZWQgaW4gdGhlIEJHUHNlY19QYXRoDQogICBhdHRyaWJ1dGUu IFR5cGljYWxseSwgYSBCR1BzZWMgc3BlYWtlciB3aWxsIGFsc28gd2lzaCB0byBwZXJmb3JtDQog ICBvcmlnaW4gdmFsaWRhdGlvbiAoc2VlIFsxOV0gYW5kIFsyMF0pIG9uIGFuIGluY29taW5nIEJH UHNlYyB1cGRhdGUNCiAgIG1lc3NhZ2UsIGJ1dCBzdWNoIHZhbGlkYXRpb24gaXMgaW5kZXBlbmRl bnQgb2YgdGhlIHZhbGlkYXRpb24NCiAgIGRlc2NyaWJlZCBpbiB0aGlzIHNlY3Rpb24uDQoNCiAg IFNlY3Rpb24gNS4xIHByb3ZpZGVzIGFuIG92ZXJ2aWV3IG9mIEJHUHNlYyB2YWxpZGF0aW9uIGFu ZCBTZWN0aW9uIDUuMg0KICAgcHJvdmlkZXMgYSBzcGVjaWZpYyBhbGdvcml0aG0gZm9yIHBlcmZv cm1pbmcgc3VjaCB2YWxpZGF0aW9uLiAgKE5vdGUNCiAgIHRoYXQgYW4gaW1wbGVtZW50YXRpb24g bmVlZCBub3QgZm9sbG93IHRoZSBzcGVjaWZpYyBhbGdvcml0aG0gaW4NCiAgIFNlY3Rpb24gNS4y IGFzIGxvbmcgYXMgdGhlIGlucHV0L291dHB1dCBiZWhhdmlvciBvZiB0aGUgdmFsaWRhdGlvbiBp cw0KICAgaWRlbnRpY2FsIHRvIHRoYXQgb2YgdGhlIGFsZ29yaXRobSBpbiBTZWN0aW9uIDUuMi4p ICBEdXJpbmcNCiAgIGV4Y2VwdGlvbmFsIGNvbmRpdGlvbnMgKGUuZy4sIHRoZSBCR1BzZWMgc3Bl YWtlciByZWNlaXZlcyBhbg0KICAgaW5jcmVkaWJseSBsYXJnZSBudW1iZXIgb2YgdXBkYXRlIG1l c3NhZ2VzIGF0IG9uY2UpIGEgQkdQc2VjIHNwZWFrZXINCiAgIE1BWSB0ZW1wb3JhcmlseSBkZWZl ciB2YWxpZGF0aW9uIG9mIGluY29taW5nIEJHUHNlYyB1cGRhdGUgbWVzc2FnZXMuDQogICBUaGUg dHJlYXRtZW50IG9mIHN1Y2ggQkdQc2VjIHVwZGF0ZSBtZXNzYWdlcywgd2hvc2UgdmFsaWRhdGlv biBoYXMNCiAgIGJlZW4gZGVmZXJyZWQsIGlzIGEgbWF0dGVyIG9mIGxvY2FsIHBvbGljeS4gSG93 ZXZlciwgYW4NCiAgIGltcGxlbWVudGF0aW9uIFNIT1VMRCBlbnN1cmUgdGhhdCBkZWZlcm1lbnQg b2YgdmFsaWRhdGlvbiBhbmQgc3RhdHVzDQogICBvZiBkZWZlcnJlZCBtZXNzYWdlcyBpcyB2aXNp YmxlIHRvIHRoZSBvcGVyYXRvci4NCg0KICAgVGhlIHZhbGlkaXR5IG9mIEJHUHNlYyB1cGRhdGUg bWVzc2FnZXMgaXMgYSBmdW5jdGlvbiBvZiB0aGUgY3VycmVudA0KICAgUlBLSSBzdGF0ZS4gIFdo ZW4gYSBCR1BzZWMgc3BlYWtlciBsZWFybnMgdGhhdCBSUEtJIHN0YXRlIGhhcyBjaGFuZ2VkDQog ICAoZS5nLiwgZnJvbSBhbiBSUEtJIHZhbGlkYXRpbmcgY2FjaGUgdmlhIHRoZSBSVFIgcHJvdG9j b2wpLCB0aGUNCiAgIEJHUHNlYyBzcGVha2VyIE1VU1QgcmUtcnVuIHZhbGlkYXRpb24gb24gYWxs IGFmZmVjdGVkIHVwZGF0ZSBtZXNzYWdlcw0KICAgc3RvcmVkIGluIGl0cyBBREotUklCLUlOLiAg VGhhdCBpcywgd2hlbiBhIGdpdmVuIFJQS0kgY2VydGlmaWNhdGUNCiAgIGNlYXNlcyB0byBiZSB2 YWxpZCAoZS5nLiwgaXQgZXhwaXJlcyBvciBpcyByZXZva2VkKSwgYWxsIHVwZGF0ZQ0KICAgbWVz c2FnZXMgY29udGFpbmluZyBhIHNpZ25hdHVyZSB3aG9zZSBTS0kgbWF0Y2hlcyB0aGUgU0tJIGlu IHRoZQ0KICAgZ2l2ZW4gY2VydGlmaWNhdGUgbXVzdCBiZSByZS1hc3Nlc3NlZCB0byBkZXRlcm1p bmUgaWYgdGhleSBhcmUgc3RpbGwNCiAgIHZhbGlkLiBJZiB0aGlzIHJlYXNzZXNzbWVudCBkZXRl cm1pbmVzIHRoYXQgdGhlIHZhbGlkaXR5IHN0YXRlIG9mIGFuDQogDQoNCg0KTGVwaW5za2kgICAg ICAgICAgICAgICAgICBFeHBpcmVzIE1heSA2LCAyMDE2ICAgICAgICAgICAgICAgICAgW1BhZ2Ug MTldDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgQkdQc2VjIFByb3RvY29sICAgICAg ICAgICAgIERlY2VtYmVyIDYsIDIwMTUNCg0KDQogICB1cGRhdGUgaGFzIGNoYW5nZWQgdGhlbiwg ZGVwZW5kaW5nIG9uIGxvY2FsIHBvbGljeSwgaXQgbWF5IGJlDQogICBuZWNlc3NhcnkgdG8gcmUt cnVuIGJlc3QgcGF0aCBzZWxlY3Rpb24uDQoNCiAgIEJHUHNlYyB1cGRhdGUgbWVzc2FnZXMgZG8g bm90IGNvbnRhaW4gYW4gQVNfUEFUSCBhdHRyaWJ1dGUuDQogICBUaGVyZWZvcmUsIGEgQkdQc2Vj IHNwZWFrZXIgTVVTVCB1dGlsaXplIHRoZSBBUyBwYXRoIGluZm9ybWF0aW9uIGluDQogICB0aGUg QkdQc2VjX1BhdGggYXR0cmlidXRlIGluIGFsbCBjYXNlcyB3aGVyZSBpdCB3b3VsZCBvdGhlcndp c2UgdXNlDQogICB0aGUgQVMgcGF0aCBpbmZvcm1hdGlvbiBpbiB0aGUgQVNfUEFUSCBhdHRyaWJ1 dGUuICBUaGUgb25seSBleGNlcHRpb24NCiAgIHRvIHRoaXMgcnVsZSBpcyB3aGVuIEFTIHBhdGgg aW5mb3JtYXRpb24gbXVzdCBiZSB1cGRhdGVkIGluIG9yZGVyIHRvDQogICBwcm9wYWdhdGUgYSBy b3V0ZSB0byBhIHBlZXIgKGluIHdoaWNoIGNhc2UgdGhlIEJHUHNlYyBzcGVha2VyIGZvbGxvd3MN CiAgIHRoZSBpbnN0cnVjdGlvbnMgaW4gU2VjdGlvbiA0KS4gIFNlY3Rpb24gNC40IHByb3ZpZGVz IGFuIGFsZ29yaXRobQ0KICAgZm9yIGNvbnN0cnVjdGluZyBhbiBBU19QQVRIIGF0dHJpYnV0ZSBm cm9tIGEgQkdQc2VjX1BhdGggYXR0cmlidXRlLg0KICAgV2hlbmV2ZXIgdGhlIHVzZSBvZiBBUyBw YXRoIGluZm9ybWF0aW9uIGlzIGNhbGxlZCBmb3IgKGUuZy4sIGxvb3ANCiAgIGRldGVjdGlvbiwg b3IgdXNlIG9mIEFTIHBhdGggbGVuZ3RoIGluIGJlc3QgcGF0aCBzZWxlY3Rpb24pIHRoZQ0KICAg ZXh0ZXJuYWxseSB2aXNpYmxlIGJlaGF2aW9yIG9mIHRoZSBpbXBsZW1lbnRhdGlvbiBzaGFsbCBi ZSB0aGUgc2FtZQ0KICAgYXMgaWYgdGhlIGltcGxlbWVudGF0aW9uIGhhZCBydW4gdGhlIGFsZ29y aXRobSBpbiBTZWN0aW9uIDQuNCBhbmQNCiAgIHVzZWQgdGhlIHJlc3VsdGluZyBBU19QQVRIIGF0 dHJpYnV0ZSBhcyBpdCB3b3VsZCBmb3IgYSBub24tQkdQc2VjDQogICB1cGRhdGUgbWVzc2FnZS4N Cg0KICAgTWFueSBzaWduYXR1cmUgYWxnb3JpdGhtcyBhcmUgbm9uLWRldGVybWluaXN0aWMuICBU aGF0IGlzLCBtYW55DQogICBzaWduYXR1cmUgYWxnb3JpdGhtcyB3aWxsIHByb2R1Y2UgZGlmZmVy ZW50IHNpZ25hdHVyZXMgZWFjaCB0aW1lIHRoZXkNCiAgIGFyZSBydW4gKGV2ZW4gd2hlbiB0aGV5 IGFyZSBzaWduaW5nIHRoZSBzYW1lIGRhdGEgd2l0aCB0aGUgc2FtZSBrZXkpLg0KICAgVGhlcmVm b3JlLCBpZiBhbiBpbXBsZW1lbnRhdGlvbiByZWNlaXZlcyBhIEJHUHNlYyB1cGRhdGUgZnJvbSBh IHBlZXINCiAgIGFuZCBsYXRlciByZWNlaXZlcyBhIHNlY29uZCBCR1BzZWMgdXBkYXRlIG1lc3Nh Z2UgZnJvbSB0aGUgc2FtZSBwZWVyLA0KICAgdGhlIGltcGxlbWVudGF0aW9uIFNIT1VMRCB0cmVh dCB0aGUgc2Vjb25kIG1lc3NhZ2UgYXMgYSBkdXBsaWNhdGUNCiAgIHVwZGF0ZSBtZXNzYWdlIGlm IGl0IGRpZmZlcnMgZnJvbSB0aGUgZmlyc3QgdXBkYXRlIG1lc3NhZ2Ugb25seSBpbg0KICAgdGhl IFNpZ25hdHVyZSBmaWVsZHMgKHdpdGhpbiB0aGUgQkdQc2VjX1BhdGggYXR0cmlidXRlKS4gIFRo YXQgaXMsIGlmDQogICBhbGwgdGhlIGZpZWxkcyBpbiB0aGUgc2Vjb25kIHVwZGF0ZSBhcmUgaWRl bnRpY2FsIHRvIHRoZSBmaWVsZHMgaW4NCiAgIHRoZSBmaXJzdCB1cGRhdGUgbWVzc2FnZSwgZXhj ZXB0IGZvciB0aGUgU2lnbmF0dXJlIGZpZWxkcywgdGhlbiB0aGUNCiAgIHNlY29uZCB1cGRhdGUg bWVzc2FnZSBzaG91bGQgYmUgdHJlYXRlZCBhcyBhIGR1cGxpY2F0ZSBvZiB0aGUgZmlyc3QNCiAg IHVwZGF0ZSBtZXNzYWdlLiAgTm90ZSB0aGF0IGlmIG90aGVyIGZpZWxkcyAoZS5nLiwgdGhlIFN1 YmplY3QgS2V5DQogICBJZGVudGlmaWVyIGZpZWxkKSB3aXRoaW4gYSBTaWduYXR1cmUgc2VnbWVu dCBkaWZmZXIgYmV0d2VlbiB0d28NCiAgIHVwZGF0ZSBtZXNzYWdlcyB0aGVuIHRoZSB0d28gdXBk YXRlcyBhcmUgbm90IGR1cGxpY2F0ZXMuDQoNCiAgIFdpdGggcmVnYXJkcyB0byB0aGUgcHJvY2Vz c2luZyBvZiBkdXBsaWNhdGUgdXBkYXRlIG1lc3NhZ2VzLCBpZiB0aGUNCiAgIGZpcnN0IHVwZGF0 ZSBtZXNzYWdlIGlzIHZhbGlkLCB0aGVuIGFuIGltcGxlbWVudGF0aW9uIFNIT1VMRCBOT1QgcnVu DQogICB0aGUgdmFsaWRhdGlvbiBwcm9jZWR1cmUgb24gdGhlIHNlY29uZCwgZHVwbGljYXRlIHVw ZGF0ZSBtZXNzYWdlDQogICAoZXZlbiBpZiB0aGUgYml0cyBvZiB0aGUgc2lnbmF0dXJlIGZpZWxk IGFyZSBkaWZmZXJlbnQpLiAgSWYgdGhlDQogICBmaXJzdCB1cGRhdGUgbWVzc2FnZSBpcyBub3Qg dmFsaWQsIHRoZW4gYW4gaW1wbGVtZW50YXRpb24gU0hPVUxEIHJ1bg0KICAgdGhlIHZhbGlkYXRp b24gcHJvY2VkdXJlIG9uIHRoZSBzZWNvbmQgZHVwbGljYXRlIHVwZGF0ZSBtZXNzYWdlIChhcw0K ICAgdGhlIHNpZ25hdHVyZXMgaW4gdGhlIHNlY29uZCB1cGRhdGUgbWF5IGJlIHZhbGlkIGV2ZW4g dGhvdWdoIHRoZQ0KICAgZmlyc3QgY29udGFpbmVkIGEgc2lnbmF0dXJlIHRoYXQgd2FzIGludmFs aWQpLg0KDQo1LjEuICBPdmVydmlldyBvZiBCR1BzZWMgVmFsaWRhdGlvbg0KDQogICBWYWxpZGF0 aW9uIG9mIGEgQkdQc2VjIHVwZGF0ZSBtZXNzYWdlcyBtYWtlcyB1c2Ugb2YgZGF0YSBmcm9tIFJQ S0kNCiAgIGNlcnRpZmljYXRlcyBhbmQgc2lnbmVkIFJvdXRlIE9yaWdpbmF0aW9uIEF1dGhvcml6 YXRpb25zIChST0EpLiAgSW4NCiAgIHBhcnRpY3VsYXIsIHRvIHZhbGlkYXRlIHVwZGF0ZSBtZXNz YWdlcyBjb250YWluaW5nIHRoZSBCR1BzZWNfUGF0aA0KICAgYXR0cmlidXRlLCBpdCBpcyBuZWNl c3NhcnkgdGhhdCB0aGUgcmVjaXBpZW50IGhhdmUgYWNjZXNzIHRvIHRoZQ0KIA0KDQoNCkxlcGlu c2tpICAgICAgICAgICAgICAgICAgRXhwaXJlcyBNYXkgNiwgMjAxNiAgICAgICAgICAgICAgICAg IFtQYWdlIDIwXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgIEJHUHNlYyBQcm90b2Nv bCAgICAgICAgICAgICBEZWNlbWJlciA2LCAyMDE1DQoNCg0KICAgZm9sbG93aW5nIGRhdGEgb2J0 YWluZWQgZnJvbSB2YWxpZCBSUEtJIGNlcnRpZmljYXRlcyBhbmQgUk9BczoNCg0KICAgbyAgRm9y IGVhY2ggdmFsaWQgUlBLSSByb3V0ZXIgY2VydGlmaWNhdGUsIHRoZSBBUyBOdW1iZXIsIFB1Ymxp YyBLZXkNCiAgICAgIGFuZCBTdWJqZWN0IEtleSBJZGVudGlmaWVyIGFyZSByZXF1aXJlZCwNCg0K ICAgbyAgRm9yIGVhY2ggdmFsaWQgUk9BLCB0aGUgQVMgTnVtYmVyIGFuZCB0aGUgbGlzdCBvZiBJ UCBhZGRyZXNzDQogICAgICBwcmVmaXhlcy4NCg0KICAgTm90ZSB0aGF0IHRoZSBCR1BzZWMgc3Bl YWtlciBjb3VsZCBwZXJmb3JtIHRoZSB2YWxpZGF0aW9uIG9mIFJQS0kNCiAgIGNlcnRpZmljYXRl cyBhbmQgUk9BcyBvbiBpdHMgb3duIGFuZCBleHRyYWN0IHRoZSByZXF1aXJlZCBkYXRhLCBvciBp dA0KICAgY291bGQgcmVjZWl2ZSB0aGUgc2FtZSBkYXRhIGZyb20gYSB0cnVzdGVkIGNhY2hlIHRo YXQgcGVyZm9ybXMgUlBLSQ0KICAgdmFsaWRhdGlvbiBvbiBiZWhhbGYgb2YgKHNvbWUgc2V0IG9m KSBCR1BzZWMgc3BlYWtlcnMuICAoRm9yIGV4YW1wbGUsDQogICB0aGUgdHJ1c3RlZCBjYWNoZSBj b3VsZCBkZWxpdmVyIHRoZSBuZWNlc3NhcnkgdmFsaWRpdHkgaW5mb3JtYXRpb24gdG8NCiAgIHRo ZSBCR1BzZWMgc3BlYWtlciB1c2luZyB0aGUgcm91dGVyIGtleSBQRFUgWzE2XSBmb3IgdGhlIFJU UiBwcm90b2NvbA0KICAgWzE1XS4pDQoNCiAgIFRvIHZhbGlkYXRlIGEgQkdQc2VjIHVwZGF0ZSBt ZXNzYWdlIGNvbnRhaW5pbmcgdGhlIEJHUHNlY19QYXRoDQogICBhdHRyaWJ1dGUsIHRoZSByZWNp cGllbnQgcGVyZm9ybXMgdGhlIHZhbGlkYXRpb24gc3RlcHMgc3BlY2lmaWVkIGluDQogICBTZWN0 aW9uIDUuMi4gIFRoZSB2YWxpZGF0aW9uIHByb2NlZHVyZSByZXN1bHRzIGluIG9uZSBvZiB0d28g c3RhdGVzOg0KICAgJ1ZhbGlkJyBhbmQgJ05vdCBWYWxpZCcuDQoNCiAgIEl0IGlzIGV4cGVjdGVk IHRoYXQgdGhlIG91dHB1dCBvZiB0aGUgdmFsaWRhdGlvbiBwcm9jZWR1cmUgd2lsbCBiZQ0KICAg dXNlZCBhcyBhbiBpbnB1dCB0byBCR1Agcm91dGUgc2VsZWN0aW9uLiAgVGhhdCBzYWlkLCBCR1Ag cm91dGUNCiAgIHNlbGVjdGlvbiwgYW5kIHRodXMgdGhlIGhhbmRsaW5nIG9mIHRoZSB2YWxpZGF0 aW9uIHN0YXRlcyBpcyBhIG1hdHRlcg0KICAgb2YgbG9jYWwgcG9saWN5LCBhbmQgaXMgaGFuZGxl ZCB1c2luZyBsb2NhbCBwb2xpY3kgbWVjaGFuaXNtcy4NCiAgIEltcGxlbWVudGF0aW9ucyBTSE9V TEQgZW5hYmxlIG9wZXJhdG9ycyB0byBzZXQgc3VjaCBsb2NhbCBwb2xpY3kgb24gYQ0KICAgcGVy LXNlc3Npb24gYmFzaXMuIChUaGF0IGlzLCB3ZSBleHBlY3Qgc29tZSBvcGVyYXRvcnMgd2lsbCBj aG9vc2UgdG8NCiAgIHRyZWF0IEJHUFNFQyB2YWxpZGF0aW9uIHN0YXR1cyBkaWZmZXJlbnRseSBm b3IgdXBkYXRlIG1lc3NhZ2VzDQogICByZWNlaXZlZCBvdmVyIGRpZmZlcmVudCBCR1Agc2Vzc2lv bnMuKQ0KDQogICBJdCBpcyBleHBlY3RlZCB0aGF0IEJHUCBwZWVycyB3aWxsIGdlbmVyYWxseSBw cmVmZXIgcm91dGVzIHJlY2VpdmVkDQogICB2aWEgJ1ZhbGlkJyBCR1BzZWMgdXBkYXRlIG1lc3Nh Z2VzIG92ZXIgYm90aCByb3V0ZXMgcmVjZWl2ZWQgdmlhICdOb3QNCiAgIFZhbGlkJyBCR1BzZWMg dXBkYXRlIG1lc3NhZ2VzIGFuZCByb3V0ZXMgcmVjZWl2ZWQgdmlhIHVwZGF0ZSBtZXNzYWdlcw0K ICAgdGhhdCBkbyBub3QgY29udGFpbiB0aGUgQkdQc2VjX1BhdGggYXR0cmlidXRlLiAgSG93ZXZl ciwgQkdQc2VjDQogICBzcGVjaWZpZXMgbm8gY2hhbmdlcyB0byB0aGUgQkdQIGRlY2lzaW9uIHBy b2Nlc3MuICAoU2VlIFsxN10gZm9yDQogICByZWxhdGVkIG9wZXJhdGlvbmFsIGNvbnNpZGVyYXRp b25zLikNCg0KICAgQkdQc2VjIHZhbGlkYXRpb24gbmVlZHMgb25seSBiZSBwZXJmb3JtZWQgYXQg dGhlIGVCR1AgZWRnZS4gIFRoZQ0KICAgdmFsaWRhdGlvbiBzdGF0dXMgb2YgYSBCR1Agc2lnbmVk L3Vuc2lnbmVkIHVwZGF0ZSBNQVkgYmUgY29udmV5ZWQgdmlhDQogICBpQkdQIGZyb20gYW4gaW5n cmVzcyBlZGdlIHJvdXRlciB0byBhbiBlZ3Jlc3MgZWRnZSByb3V0ZXIgdmlhIHNvbWUNCiAgIG1l Y2hhbmlzbSwgYWNjb3JkaW5nIHRvIGxvY2FsIHBvbGljeSB3aXRoaW4gYW4gQVMuICBBcyBkaXNj dXNzZWQgaW4NCiAgIFNlY3Rpb24gNCwgd2hlbiBhIEJHUHNlYyBzcGVha2VyIGNob29zZXMgdG8g Zm9yd2FyZCBhIChzeW50YWN0aWNhbGx5DQogICBjb3JyZWN0KSBCR1BzZWMgdXBkYXRlIG1lc3Nh Z2UsIGl0IFNIT1VMRCBiZSBmb3J3YXJkZWQgd2l0aCBpdHMNCiAgIEJHUHNlY19QYXRoIGF0dHJp YnV0ZSBpbnRhY3QgKHJlZ2FyZGxlc3Mgb2YgdGhlIHZhbGlkYXRpb24gc3RhdGUgb2YNCiAgIHRo ZSB1cGRhdGUgbWVzc2FnZSkuICBCYXNlZCBlbnRpcmVseSBvbiBsb2NhbCBwb2xpY3ksIGFuIGVn cmVzcw0KICAgcm91dGVyIHJlY2VpdmluZyBhIEJHUHNlYyB1cGRhdGUgbWVzc2FnZSBmcm9tIHdp dGhpbiBpdHMgb3duIEFTIE1BWQ0KICAgY2hvb3NlIHRvIHBlcmZvcm0gaXRzIG93biB2YWxpZGF0 aW9uLg0KDQogDQoNCg0KTGVwaW5za2kgICAgICAgICAgICAgICAgICBFeHBpcmVzIE1heSA2LCAy MDE2ICAgICAgICAgICAgICAgICAgW1BhZ2UgMjFdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICAg ICAgICAgQkdQc2VjIFByb3RvY29sICAgICAgICAgICAgIERlY2VtYmVyIDYsIDIwMTUNCg0KDQo1 LjIuICBWYWxpZGF0aW9uIEFsZ29yaXRobQ0KDQogICBUaGlzIHNlY3Rpb24gc3BlY2lmaWVzIGFu IGFsZ29yaXRobSBmb3IgdmFsaWRhdGlvbiBvZiBCR1BzZWMgdXBkYXRlDQogICBtZXNzYWdlcy4g IEEgY29uZm9ybWFudCBpbXBsZW1lbnRhdGlvbiBNVVNUIGluY2x1ZGUgYSBCR1BzZWMgdXBkYXRl DQogICB2YWxpZGF0aW9uIGFsZ29yaXRobSB0aGF0IGlzIGZ1bmN0aW9uYWxseSBlcXVpdmFsZW50 IHRvIHRoZQ0KICAgZXh0ZXJuYWxseSB2aXNpYmxlIGJlaGF2aW9yIG9mIHRoaXMgYWxnb3JpdGht Lg0KDQogICBGaXJzdCwgdGhlIHJlY2lwaWVudCBvZiBhIEJHUHNlYyB1cGRhdGUgbWVzc2FnZSBw ZXJmb3JtcyBhIGNoZWNrIHRvDQogICBlbnN1cmUgdGhhdCB0aGUgbWVzc2FnZSBpcyBwcm9wZXJs eSBmb3JtZWQuICBTcGVjaWZpY2FsbHksIHRoZQ0KICAgcmVjaXBpZW50IHBlcmZvcm1zIHRoZSBm b2xsb3dpbmcgY2hlY2tzOg0KDQogICAxLiAgQ2hlY2sgdG8gZW5zdXJlIHRoYXQgdGhlIGVudGly ZSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUgaXMNCiAgICAgICBzeW50YWN0aWNhbGx5IGNvcnJlY3Qg KGNvbmZvcm1zIHRvIHRoZSBzcGVjaWZpY2F0aW9uIGluIHRoaXMNCiAgICAgICBkb2N1bWVudCku DQoNCiAgIDIuICBDaGVjayB0aGF0IGVhY2ggU2lnbmF0dXJlX0Jsb2NrIGNvbnRhaW5zIG9uZSBT aWduYXR1cmUgc2VnbWVudA0KICAgICAgIGZvciBlYWNoIFNlY3VyZV9QYXRoIHNlZ21lbnQgaW4g dGhlIFNlY3VyZV9QYXRoIHBvcnRpb24gb2YgdGhlDQogICAgICAgQkdQc2VjX1BhdGggYXR0cmli dXRlLiAgKE5vdGUgdGhhdCB0aGUgZW50aXJldHkgb2YgZWFjaA0KICAgICAgIFNpZ25hdHVyZV9C bG9jayBtdXN0IGJlIGNoZWNrZWQgdG8gZW5zdXJlIHRoYXQgaXQgaXMgd2VsbCBmb3JtZWQsDQog ICAgICAgZXZlbiB0aG91Z2ggdGhlIHZhbGlkYXRpb24gcHJvY2VzcyBtYXkgdGVybWluYXRlIGJl Zm9yZSBhbGwNCiAgICAgICBzaWduYXR1cmVzIGFyZSBjcnlwdG9ncmFwaGljYWxseSB2ZXJpZmll ZC4pDQoNCiAgIDMuICBDaGVjayB0aGF0IHRoZSB1cGRhdGUgbWVzc2FnZSBkb2VzIG5vdCBjb250 YWluIGFuIEFTX1BBVEgNCiAgICAgICBhdHRyaWJ1dGUuDQoNCiAgIDQuICBJZiB0aGUgdXBkYXRl IG1lc3NhZ2Ugd2FzIHJlY2VpdmVkIGZyb20gYSBwZWVyIHRoYXQgaXMgbm90IGENCiAgICAgICBt ZW1iZXIgb2YgdGhlIEJHUHNlYyBzcGVha2VyJ3MgQVMgY29uZmVkZXJhdGlvbiwgY2hlY2sgdG8g ZW5zdXJlDQogICAgICAgdGhhdCBub25lIG9mIHRoZSBTZWN1cmVfUGF0aCBzZWdtZW50cyBjb250 YWluIGEgRmxhZ3MgZmllbGQgd2l0aA0KICAgICAgIHRoZSBDb25mZWRfU2VxdWVuY2UgZmxhZyBz ZXQgdG8gb25lLg0KDQogICA1LiAgSWYgdGhlIHVwZGF0ZSBtZXNzYWdlIHdhcyByZWNlaXZlZCBm cm9tIGEgcGVlciB0aGF0IGlzIG5vdA0KICAgICAgIGV4cGVjdGVkIHRvIHNldCBwQ291bnQgZXF1 YWwgdG8gemVybyAoc2VlIFNlY3Rpb24gNC4yKSB0aGVuIGNoZWNrDQogICAgICAgdG8gZW5zdXJl IHRoYXQgdGhlIHBDb3VudCBmaWVsZCBpbiB0aGUgbW9zdC1yZWNlbnRseSBhZGRlZA0KICAgICAg IFNlY3VyZV9QYXRoIHNlZ21lbnQgaXMgbm90IGVxdWFsIHRvIHplcm8uDQoNCiAgIElmIGFueSBv ZiB0aGVzZSBjaGVja3MgZmFpbCwgaXQgaXMgYW4gZXJyb3IgaW4gdGhlIEJHUHNlY19QYXRoDQog ICBhdHRyaWJ1dGUuIEFueSBvZiB0aGVzZSBlcnJvcnMgaW4gdGhlIEJHUHNlY19QYXRoIGF0dHJp YnV0ZSBhcmUNCiAgIGhhbmRsZWQgYXMgcGVyIFJGQyBXWFlaIFsxMV0uIEJHUHNlYyBzcGVha2Vy cyBNVVNUIGhhbmRsZSB0aGVzZQ0KICAgZXJyb3JzIHVzaW5nIHRoZSAidHJlYXQtYXMtd2l0aGRy YXciIGFwcHJvYWNoIGFzIGRlZmluZWQgaW4gUkZDIFdYWVoNCiAgIFsxMV0uDQoNCiAgIE5leHQs IHRoZSBCR1BzZWMgc3BlYWtlciBleGFtaW5lcyB0aGUgU2lnbmF0dXJlX0Jsb2NrcyBpbiB0aGUN CiAgIEJHUHNlY19QYXRoIGF0dHJpYnV0ZS4gIEEgU2lnbmF0dXJlX0Jsb2NrIGNvcnJlc3BvbmRp bmcgdG8gYW4NCiAgIGFsZ29yaXRobSBzdWl0ZSB0aGF0IHRoZSBCR1BzZWMgc3BlYWtlciBkb2Vz IG5vdCBzdXBwb3J0IGlzIG5vdA0KICAgY29uc2lkZXJlZCBpbiB2YWxpZGF0aW9uLiAgSWYgdGhl cmUgaXMgbm8gU2lnbmF0dXJlX0Jsb2NrDQogICBjb3JyZXNwb25kaW5nIHRvIGFuIGFsZ29yaXRo bSBzdWl0ZSB0aGF0IHRoZSBCR1BzZWMgc3BlYWtlciBzdXBwb3J0cywNCiAgIHRoZW4gdGhlIEJH UHNlYyBzcGVha2VyIE1VU1QgdHJlYXQgdGhlIHVwZGF0ZSBtZXNzYWdlIGluIHRoZSBzYW1lDQog ICBtYW5uZXIgdGhhdCB0aGUgQkdQc2VjIHNwZWFrZXIgd291bGQgdHJlYXQgYW4gKHVuc2lnbmVk KSB1cGRhdGUNCiANCg0KDQpMZXBpbnNraSAgICAgICAgICAgICAgICAgIEV4cGlyZXMgTWF5IDYs IDIwMTYgICAgICAgICAgICAgICAgICBbUGFnZSAyMl0NCgwNCkludGVybmV0LURyYWZ0ICAgICAg ICAgICAgICBCR1BzZWMgUHJvdG9jb2wgICAgICAgICAgICAgRGVjZW1iZXIgNiwgMjAxNQ0KDQoN CiAgIG1lc3NhZ2UgdGhhdCBhcnJpdmVkIHdpdGhvdXQgYSBCR1BzZWNfUGF0aCBhdHRyaWJ1dGUu DQoNCiAgIEZvciBlYWNoIHJlbWFpbmluZyBTaWduYXR1cmVfQmxvY2sgKGNvcnJlc3BvbmRpbmcg dG8gYW4gYWxnb3JpdGhtDQogICBzdWl0ZSBzdXBwb3J0ZWQgYnkgdGhlIEJHUHNlYyBzcGVha2Vy KSwgdGhlIEJHUHNlYyBzcGVha2VyIGl0ZXJhdGVzDQogICB0aHJvdWdoIHRoZSBTaWduYXR1cmUg c2VnbWVudHMgaW4gdGhlIFNpZ25hdHVyZV9CbG9jaywgc3RhcnRpbmcgd2l0aA0KICAgdGhlIG1v c3QgcmVjZW50bHkgYWRkZWQgc2VnbWVudCAoYW5kIGNvbmNsdWRpbmcgd2l0aCB0aGUgbGVhc3QN CiAgIHJlY2VudGx5IGFkZGVkIHNlZ21lbnQpLiAgTm90ZSB0aGF0IHRoZXJlIGlzIGEgb25lLXRv LW9uZQ0KICAgY29ycmVzcG9uZGVuY2UgYmV0d2VlbiBTaWduYXR1cmUgc2VnbWVudHMgYW5kIFNl Y3VyZV9QYXRoIHNlZ21lbnRzDQogICB3aXRoaW4gdGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZS4g IFRoZSBmb2xsb3dpbmcgc3RlcHMgbWFrZSB1c2Ugb2YNCiAgIHRoaXMgY29ycmVzcG9uZGVuY2Uu DQoNCiAgIG8gIChTdGVwIEkpOiBMb2NhdGUgdGhlIHB1YmxpYyBrZXkgbmVlZGVkIHRvIHZlcmlm eSB0aGUgc2lnbmF0dXJlIChpbg0KICAgICAgdGhlIGN1cnJlbnQgU2lnbmF0dXJlIHNlZ21lbnQp LiAgVG8gZG8gdGhpcywgY29uc3VsdCB0aGUgdmFsaWQNCiAgICAgIFJQS0kgcm91dGVyIGNlcnRp ZmljYXRlIGRhdGEgYW5kIGxvb2sgdXAgYWxsIHZhbGlkIChBUywgU0tJLA0KICAgICAgUHVibGlj IEtleSkgdHJpcGxlcyBpbiB3aGljaCB0aGUgQVMgbWF0Y2hlcyB0aGUgQVMgbnVtYmVyIGluIHRo ZQ0KICAgICAgY29ycmVzcG9uZGluZyBTZWN1cmVfUGF0aCBzZWdtZW50LiAgT2YgdGhlc2UgdHJp cGxlcyB0aGF0IG1hdGNoDQogICAgICB0aGUgQVMgbnVtYmVyLCBjaGVjayB3aGV0aGVyIHRoZXJl IGlzIGFuIFNLSSB0aGF0IG1hdGNoZXMgdGhlDQogICAgICB2YWx1ZSBpbiB0aGUgU3ViamVjdCBL ZXkgSWRlbnRpZmllciBmaWVsZCBvZiB0aGUgU2lnbmF0dXJlDQogICAgICBzZWdtZW50LiAgSWYg dGhpcyBjaGVjayBmaW5kcyBubyBzdWNoIG1hdGNoaW5nIFNLSSB2YWx1ZSwgdGhlbg0KICAgICAg bWFyayB0aGUgZW50aXJlIFNpZ25hdHVyZV9CbG9jayBhcyAnTm90IFZhbGlkJyBhbmQgcHJvY2Vl ZCB0byB0aGUNCiAgICAgIG5leHQgU2lnbmF0dXJlX0Jsb2NrLg0KDQogICBvICAoU3RlcCBJSSk6 IENvbXB1dGUgdGhlIGRpZ2VzdCBmdW5jdGlvbiAoZm9yIHRoZSBnaXZlbiBhbGdvcml0aG0NCiAg ICAgIHN1aXRlKSBvbiB0aGUgYXBwcm9wcmlhdGUgZGF0YS4gDQoNCiAgICAgICAgICAgIFNlcXVl bmNlIG9mIE9jdGV0cyB0byBiZSBIYXNoZWQNCiAgICAgICstLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tKw0KICAgICAgfCBBUyBOdW1iZXIgb2YgVGFyZ2V0ICAgICAgKDQgb2N0 ZXRzKSB8DQogICAgICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsNCiAg ICAgIHwgQVMgTnVtYmVyICAgICAgICAgICAgICAgICg0IG9jdGV0cykgfCAgDQogICAgICArLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsgICAgDQogICAgICB8IHBDb3VudCAg ICAgICAgICAgICAgICAgICAoMSBvY3RldCkgIHwgIA0KICAgICAgKy0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0rICANCiAgICAgIHwgRmxhZ3MgICAgICAgICAgICAgICAgICAg ICgxIG9jdGV0KSAgfCAgDQogICAgICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLSsNCiAgICAgIHwgUmVzdCBvZiBTZWN1cmVfUGF0aCAgICAgICh2YXJpYWJsZSkgfA0KICAg ICAgKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rDQogICAgICB8IFJlc3Qg b2YgU2lnbmF0dXJlX0Jsb2NrICAodmFyaWFibGUpIHwNCiAgICAgICstLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tKw0KICAgICAgfCBBRkkgICAgICAgICAgICAgICAgICAgICAg KDIgb2N0ZXRzKSB8ICAtLS1cDQogICAgICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLSsgICAgICBcDQogICAgICB8IFNBRkkgICAgICAgICAgICAgICAgICAgICAoMSBvY3Rl dCkgIHwgICAgICAgPiAgTVBfUkVBQ0hfTkxSSQ0KICAgICAgKy0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0rICAgICAgLw0KICAgICAgfCBOTFJJICAgICAgICAgICAgICAgICAg ICAgKHZhcmlhYmxlKSB8ICAtLS0vDQogICAgICArLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLSsNCg0KDQogICBGb3IgdGhlIGZpcnN0IHNlZ21lbnQgdG8gYmUgcHJvY2Vzc2Vk ICh0aGUgbW9zdCByZWNlbnRseSBhZGRlZA0KIA0KDQoNCkxlcGluc2tpICAgICAgICAgICAgICAg ICAgRXhwaXJlcyBNYXkgNiwgMjAxNiAgICAgICAgICAgICAgICAgIFtQYWdlIDIzXQ0KDA0KSW50 ZXJuZXQtRHJhZnQgICAgICAgICAgICAgIEJHUHNlYyBQcm90b2NvbCAgICAgICAgICAgICBEZWNl bWJlciA2LCAyMDE1DQoNCg0KICAgc2VnbWVudCksIHRoZSAnQVMgTnVtYmVyIG9mIFRhcmdldCBB UycgaXMgdGhlIEFTIG51bWJlciBvZiB0aGUgQkdQc2VjDQogICBzcGVha2VyIHZhbGlkYXRpbmcg dGhlIHVwZGF0ZSBtZXNzYWdlLiAgTm90ZSB0aGF0IGlmIGEgQkdQc2VjIHNwZWFrZXINCiAgIHVz ZXMgbXVsdGlwbGUgQVMgTnVtYmVycyAoZS5nLiwgdGhlIEJHUHNlYyBzcGVha2VyIGlzIGEgbWVt YmVyIG9mIGENCiAgIGNvbmZlZGVyYXRpb24pLCB0aGUgQVMgbnVtYmVyIHVzZWQgaGVyZSBNVVNU IGJlIHRoZSBBUyBudW1iZXINCiAgIGFubm91bmNlZCBpbiB0aGUgT1BFTiBtZXNzYWdlIGZvciB0 aGUgQkdQIHNlc3Npb24gb3ZlciB3aGljaCB0aGUNCiAgIEJHUHNlYyB1cGRhdGUgd2FzIHJlY2Vp dmVkLg0KDQogICBGb3IgZWFjaCBvdGhlciBTaWduYXR1cmUgU2VnbWVudCwgdGhlICdBUyBOdW1i ZXIgb2YgVGFyZ2V0IEFTJyBpcyB0aGUNCiAgIEFTIG51bWJlciBpbiB0aGUgU2VjdXJlX1BhdGgg c2VnbWVudCB0aGF0IGNvcnJlc3BvbmRzIHRvIHRoZQ0KICAgU2lnbmF0dXJlIFNlZ21lbnQgYWRk ZWQgaW1tZWRpYXRlbHkgYWZ0ZXIgdGhlIG9uZSBiZWluZyBwcm9jZXNzZWQuDQogICAoVGhhdCBp cywgaW4gdGhlIFNlY3VyZV9QYXRoIHNlZ21lbnQgdGhhdCBjb3JyZXNwb25kcyB0byB0aGUNCiAg IFNpZ25hdHVyZSBzZWdtZW50IHRoYXQgdGhlIHZhbGlkYXRvciBqdXN0IGZpbmlzaGVkIHByb2Nl c3NpbmcuKQ0KDQogICBUaGUgQVMgTnVtYmVyLCBwQ291bnQgYW5kIEZsYWdzIGZpZWxkcyBhcmUg dGFrZW4gZnJvbSB0aGUgU2VjdXJlX1BhdGgNCiAgIHNlZ21lbnQgdGhhdCBjb3JyZXNwb25kcyB0 byB0aGUgU2lnbmF0dXJlIHNlZ21lbnQgY3VycmVudGx5IGJlaW5nDQogICBwcm9jZXNzZWQuICBU aGUgJ1Jlc3Qgb2YgU2VjdXJlX1BhdGgnIGlzIG9idGFpbmVkIGJ5IHJlbW92aW5nIGZyb20NCiAg IHRoZSBTZWN1cmVfUGF0aCB0aGUgc2VnbWVudCB0aGF0IGlzIGN1cnJlbnRseSBiZWluZyBwcm9j ZXNzZXMuIFRoYXQNCiAgIGlzLCAnUmVzdCBvZiBTZWN1cmVfUGF0aCcgaXMgd2hhdCB0aGUgU2Vj dXJlX1BhdGggd291bGQgaGF2ZQ0KICAgY29udGFpbmVkIGJlZm9yZSB0aGUgY3VycmVudGx5IHBy b2Nlc3NlZCBzZWdtZW50IHdhcyBhZGRlZC4NCiAgIFNpbWlsYXJseSwgdGhlICdSZXN0IG9mIFNp Z25hdHVyZV9CbG9jaycgaXMgb2J0YWluZWQgYnkgcmVtb3ZpbmcgZnJvbQ0KICAgdGhlIFNpZ25h dHVyZV9CbG9jayB0aGUgU2lnbmF0dXJlIFNlZ21lbnQgY29ycmVzcG9uZGluZyB0byB0aGUNCiAg IGN1cnJlbnQgU2VjdXJlX1BhdGggU2VnbWVudC4gVGhhdCBpcywgJ1Jlc3Qgb2YgU2lnbmF0dXJl X0Jsb2NrJyBpcw0KICAgd2hhdCB0aGUgU2lnbmF0dXJlX0Jsb2NrIHdvdWxkIGhhdmUgY29udGFp bmVkIGJlZm9yZSB0aGUgY3VycmVudGx5DQogICBwcm9jZXNzZWQgc2VnbWVudCB3YXMgYWRkZWQu DQoNCiAgIFRoZSBBZGRyZXNzIEZhbWlseSBJZGVudGlmaWVyIChBRkkpLCBTdWJzZXF1ZW50IEFk ZHJlc3MgRmFtaWx5DQogICBJZGVudGlmaWVyIChTQUZJKSwgYW5kIE5ldHdvcmsgTGF5ZXIgUmVh Y2hhYmlsaXR5IEluZm9ybWF0aW9uIChOTFJJKQ0KICAgYXJlIG9idGFpbmVkIGRpcmVjdGx5IGZy b20gdGhlIE1QX1JFQUNIX05MUkkgYXR0cmlidXRlIG9mIHRoZSB1cGRhdGUNCiAgIG1lc3NhZ2Uu IEhvd2V2ZXIsIGluIHRoZSBQcmVmaXggZmllbGQgb2YgdGhlIE5MUkkgKGZyb20NCiAgIE1QX1JF QUNIX05MUkkpLCBhbGwgb2YgdGhlIHRyYWlsaW5nIGJpdHMgTVVTVCBiZSBzZXQgdG8gemVybyBm b3IgdGhlDQogICBwdXJwb3NlIG9mIHNpZ25hdHVyZSB2ZXJpZmljYXRpb24uDQoNCiAgIG8gIChT dGVwIElJSSk6IFVzZSB0aGUgc2lnbmF0dXJlIHZhbGlkYXRpb24gYWxnb3JpdGhtIChmb3IgdGhl IGdpdmVuDQogICAgICBhbGdvcml0aG0gc3VpdGUpIHRvIHZlcmlmeSB0aGUgc2lnbmF0dXJlIGlu IHRoZSBjdXJyZW50IHNlZ21lbnQuDQogICAgICBUaGF0IGlzLCBpbnZva2UgdGhlIHNpZ25hdHVy ZSB2YWxpZGF0aW9uIGFsZ29yaXRobSBvbiB0aGUNCiAgICAgIGZvbGxvd2luZyB0aHJlZSBpbnB1 dHM6IHRoZSB2YWx1ZSBvZiB0aGUgU2lnbmF0dXJlIGZpZWxkIGluIHRoZQ0KICAgICAgY3VycmVu dCBzZWdtZW50OyB0aGUgZGlnZXN0IHZhbHVlIGNvbXB1dGVkIGluIFN0ZXAgSUkgYWJvdmU7IGFu ZA0KICAgICAgdGhlIHB1YmxpYyBrZXkgb2J0YWluZWQgZnJvbSB0aGUgdmFsaWQgUlBLSSBkYXRh IGluIFN0ZXAgSSBhYm92ZS4NCiAgICAgIElmIHRoZSBzaWduYXR1cmUgdmFsaWRhdGlvbiBhbGdv cml0aG0gZGV0ZXJtaW5lcyB0aGF0IHRoZQ0KICAgICAgc2lnbmF0dXJlIGlzIGludmFsaWQsIHRo ZW4gbWFyayB0aGUgZW50aXJlIFNpZ25hdHVyZV9CbG9jayBhcyAnTm90DQogICAgICBWYWxpZCcg YW5kIHByb2NlZWQgdG8gdGhlIG5leHQgU2lnbmF0dXJlX0Jsb2NrLiAgSWYgdGhlIHNpZ25hdHVy ZQ0KICAgICAgdmFsaWRhdGlvbiBhbGdvcml0aG0gZGV0ZXJtaW5lcyB0aGF0IHRoZSBzaWduYXR1 cmUgaXMgdmFsaWQsIHRoZW4NCiAgICAgIGNvbnRpbnVlIHByb2Nlc3NpbmcgU2lnbmF0dXJlIFNl Z21lbnRzICh3aXRoaW4gdGhlIGN1cnJlbnQNCiAgICAgIFNpZ25hdHVyZV9CbG9jaykuDQoNCiAg IElmIGFsbCBTaWduYXR1cmUgU2VnbWVudHMgd2l0aGluIGEgU2lnbmF0dXJlX0Jsb2NrIHBhc3Mg dmFsaWRhdGlvbg0KICAgKGkuZS4sIGFsbCBzZWdtZW50cyBhcmUgcHJvY2Vzc2VkIGFuZCB0aGUg U2lnbmF0dXJlX0Jsb2NrIGhhcyBub3QgeWV0DQogICBiZWVuIG1hcmtlZCAnTm90IFZhbGlkJyks IHRoZW4gdGhlIFNpZ25hdHVyZV9CbG9jayBpcyBtYXJrZWQgYXMNCiANCg0KDQpMZXBpbnNraSAg ICAgICAgICAgICAgICAgIEV4cGlyZXMgTWF5IDYsIDIwMTYgICAgICAgICAgICAgICAgICBbUGFn ZSAyNF0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgICAgICAgICBCR1BzZWMgUHJvdG9jb2wgICAg ICAgICAgICAgRGVjZW1iZXIgNiwgMjAxNQ0KDQoNCiAgICdWYWxpZCcuDQoNCg0KICAgSWYgYXQg bGVhc3Qgb25lIFNpZ25hdHVyZV9CbG9jayBpcyBtYXJrZWQgYXMgJ1ZhbGlkJywgdGhlbiB0aGUN CiAgIHZhbGlkYXRpb24gYWxnb3JpdGhtIHRlcm1pbmF0ZXMgYW5kIHRoZSBCR1BzZWMgdXBkYXRl IG1lc3NhZ2UgaXMNCiAgIGRlZW1lZCB0byBiZSAnVmFsaWQnLiAgKFRoYXQgaXMsIGlmIGEgQkdQ c2VjIHVwZGF0ZSBtZXNzYWdlIGNvbnRhaW5zDQogICB0d28gU2lnbmF0dXJlX0Jsb2NrcyB0aGVu IHRoZSB1cGRhdGUgbWVzc2FnZSBpcyBkZWVtZWQgJ1ZhbGlkJyBpZiB0aGUNCiAgIGZpcnN0IFNp Z25hdHVyZV9CbG9jayBpcyBtYXJrZWQgJ1ZhbGlkJyBPUiB0aGUgc2Vjb25kIFNpZ25hdHVyZV9C bG9jaw0KICAgaXMgbWFya2VkICdWYWxpZCcuKQ0KDQoNCjYuICBBbGdvcml0aG1zIGFuZCBFeHRl bnNpYmlsaXR5DQoNCjYuMS4gIEFsZ29yaXRobSBTdWl0ZSBDb25zaWRlcmF0aW9ucw0KDQogICBO b3RlIHRoYXQgdGhlcmUgaXMgY3VycmVudGx5IG5vIHN1cHBvcnQgZm9yIGJpbGF0ZXJhbCBuZWdv dGlhdGlvbg0KICAgKHVzaW5nIEJHUCBjYXBhYmlsaXRpZXMpIGJldHdlZW4gQkdQc2VjIHBlZXJz IHRvIHVzZSBvZiBhIHBhcnRpY3VsYXINCiAgIChkaWdlc3QgYW5kIHNpZ25hdHVyZSkgYWxnb3Jp dGhtIHN1aXRlLiBUaGlzIGlzIGJlY2F1c2UgdGhlIGFsZ29yaXRobQ0KICAgc3VpdGUgdXNlZCBi eSB0aGUgc2VuZGVyIG9mIGEgQkdQc2VjIHVwZGF0ZSBtZXNzYWdlIG11c3QgYmUNCiAgIHVuZGVy c3Rvb2Qgbm90IG9ubHkgYnkgdGhlIHBlZXIgdG8gd2hvbSBoZSBpcyBkaXJlY3RseSBzZW5kaW5n IHRoZQ0KICAgbWVzc2FnZSwgYnV0IGFsc28gYnkgYWxsIEJHUHNlYyBzcGVha2VycyB0byB3aG9t IHRoZSByb3V0ZQ0KICAgYWR2ZXJ0aXNlbWVudCBpcyBldmVudHVhbGx5IHByb3BhZ2F0ZWQuICBU aGVyZWZvcmUsIHNlbGVjdGlvbiBvZiBhbg0KICAgYWxnb3JpdGhtIHN1aXRlIGNhbm5vdCBiZSBh IGxvY2FsIG1hdHRlciBuZWdvdGlhdGVkIGJ5IEJHUCBwZWVycywgYnV0DQogICBpbnN0ZWFkIG11 c3QgYmUgY29vcmRpbmF0ZWQgdGhyb3VnaG91dCB0aGUgSW50ZXJuZXQuDQoNCiAgIFRvIHRoaXMg ZW5kLCBhIG1hbmRhdG9yeSBhbGdvcml0aG0gc3VpdGVzIGRvY3VtZW50IHdpbGwgYmUgY3JlYXRl ZA0KICAgd2hpY2ggc3BlY2lmaWVzIGEgbWFuZGF0b3J5LXRvLXVzZSAnY3VycmVudCcgYWxnb3Jp dGhtIHN1aXRlIGZvciB1c2UNCiAgIGJ5IGFsbCBCR1BzZWMgc3BlYWtlcnMgWzEwXS4NCg0KICAg V2UgYW50aWNpcGF0ZSB0aGF0LCBpbiB0aGUgZnV0dXJlLCB0aGUgbWFuZGF0b3J5IGFsZ29yaXRo bSBzdWl0ZXMNCiAgIGRvY3VtZW50IHdpbGwgYmUgdXBkYXRlZCB0byBzcGVjaWZ5IGEgdHJhbnNp dGlvbiBmcm9tIHRoZSAnY3VycmVudCcNCiAgIGFsZ29yaXRobSBzdWl0ZSB0byBhICduZXcnIGFs Z29yaXRobSBzdWl0ZS4gIER1cmluZyB0aGUgcGVyaW9kIG9mDQogICB0cmFuc2l0aW9uIChsaWtl bHkgYSBzbWFsbCBudW1iZXIgb2YgeWVhcnMpLCBhbGwgQkdQc2VjIHVwZGF0ZQ0KICAgbWVzc2Fn ZXMgU0hPVUxEIHNpbXVsdGFuZW91c2x5IHVzZSBib3RoIHRoZSAnY3VycmVudCcgYWxnb3JpdGht IHN1aXRlDQogICBhbmQgdGhlICduZXcnIGFsZ29yaXRobSBzdWl0ZS4gIChOb3RlIHRoYXQgU2Vj dGlvbnMgMyBhbmQgNCBzcGVjaWZ5DQogICBob3cgdGhlIEJHUHNlY19QYXRoIGF0dHJpYnV0ZSBj YW4gY29udGFpbiBzaWduYXR1cmVzLCBpbiBwYXJhbGxlbCwNCiAgIGZvciB0d28gYWxnb3JpdGht IHN1aXRlcy4pICBPbmNlIHRoZSB0cmFuc2l0aW9uIGlzIGNvbXBsZXRlLCB1c2Ugb2YNCiAgIHRo ZSBvbGQgJ2N1cnJlbnQnIGFsZ29yaXRobSB3aWxsIGJlIGRlcHJlY2F0ZWQsIHVzZSBvZiB0aGUg J25ldycNCiAgIGFsZ29yaXRobSB3aWxsIGJlIG1hbmRhdG9yeSwgYW5kIGEgc3Vic2VxdWVudCAn ZXZlbiBuZXdlcicgYWxnb3JpdGhtDQogICBzdWl0ZSBtYXkgYmUgc3BlY2lmaWVkIGFzIHJlY29t bWVuZCB0byBpbXBsZW1lbnQuICBPbmNlIHRoZQ0KICAgdHJhbnNpdGlvbiBoYXMgc3VjY2Vzc2Z1 bGx5IGJlZW4gY29tcGxldGVkIGluIHRoaXMgbWFubmVyLCBCR1BzZWMNCiAgIHNwZWFrZXJzIFNI T1VMRCBpbmNsdWRlIG9ubHkgYSBzaW5nbGUgU2lnbmF0dXJlX0Jsb2NrIChjb3JyZXNwb25kaW5n DQogICB0byB0aGUgJ25ldycgYWxnb3JpdGhtKS4NCg0KNi4yLiAgRXh0ZW5zaWJpbGl0eSBDb25z aWRlcmF0aW9ucw0KDQogICBUaGlzIHNlY3Rpb24gZGlzY3Vzc2VzIHBvdGVudGlhbCBjaGFuZ2Vz IHRvIEJHUHNlYyB0aGF0IHdvdWxkIHJlcXVpcmUNCiAgIHN1YnN0YW50aWFsIGNoYW5nZXMgdG8g dGhlIHByb2Nlc3Npbmcgb2YgdGhlIEJHUHNlY19QYXRoIGFuZCB0aHVzDQogDQoNCg0KTGVwaW5z a2kgICAgICAgICAgICAgICAgICBFeHBpcmVzIE1heSA2LCAyMDE2ICAgICAgICAgICAgICAgICAg W1BhZ2UgMjVdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgQkdQc2VjIFByb3RvY29s ICAgICAgICAgICAgIERlY2VtYmVyIDYsIDIwMTUNCg0KDQogICBuZWNlc3NpdGF0ZSBhIG5ldyB2 ZXJzaW9uIG9mIEJHUHNlYy4gIEV4YW1wbGVzIG9mIHN1Y2ggY2hhbmdlcw0KICAgaW5jbHVkZToN Cg0KDQogICBvICBBIG5ldyB0eXBlIG9mIHNpZ25hdHVyZSBhbGdvcml0aG0gdGhhdCBwcm9kdWNl cyBzaWduYXR1cmVzIG9mDQogICAgICB2YXJpYWJsZSBsZW5ndGgNCg0KICAgbyAgQSBuZXcgdHlw ZSBvZiBzaWduYXR1cmUgYWxnb3JpdGhtIGZvciB3aGljaCB0aGUgbnVtYmVyIG9mDQogICAgICBz aWduYXR1cmVzIGluIHRoZSBTaWduYXR1cmVfQmxvY2sgaXMgbm90IGVxdWFsIHRvIHRoZSBudW1i ZXIgb2YNCiAgICAgIEFTZXMgaW4gdGhlIFNlY3VyZV9QYXRoIChlLmcuLCBhZ2dyZWdhdGUgc2ln bmF0dXJlcykNCg0KICAgbyAgQ2hhbmdlcyB0byB0aGUgZGF0YSB0aGF0IGlzIHByb3RlY3RlZCBi eSB0aGUgQkdQc2VjIHNpZ25hdHVyZXMNCiAgICAgIChlLmcuLCBhdHRyaWJ1dGVzIG90aGVyIHRo YW4gdGhlIEFTIHBhdGgpDQoNCiAgIEluIHRoZSBjYXNlIHRoYXQgc3VjaCBhIGNoYW5nZSB0byBC R1BzZWMgd2VyZSBkZWVtZWQgZGVzaXJhYmxlLCBpdCBpcw0KICAgZXhwZWN0ZWQgdGhhdCBhIHN1 YnNlcXVlbnQgdmVyc2lvbiBvZiBCR1BzZWMgd291bGQgYmUgY3JlYXRlZCBhbmQNCiAgIHRoYXQg dGhpcyB2ZXJzaW9uIG9mIEJHUHNlYyB3b3VsZCBzcGVjaWZ5IGEgbmV3IEJHUCBwYXRoIGF0dHJp YnV0ZSwNCiAgIGxldCdzIGNhbGwgaXQgQkdQc2VjX1BBVEhfVFdPLCB3aGljaCBpcyBkZXNpZ25l ZCB0byBhY2NvbW1vZGF0ZSB0aGUNCiAgIGRlc2lyZWQgY2hhbmdlcyB0byBCR1BzZWMuICBJbiBz dWNoIGEgY2FzZSwgdGhlIG1hbmRhdG9yeSBhbGdvcml0aG0NCiAgIHN1aXRlcyBkb2N1bWVudCB3 b3VsZCBiZSB1cGRhdGVkIHRvIHNwZWNpZnkgYWxnb3JpdGhtIHN1aXRlcw0KICAgYXBwcm9wcmlh dGUgZm9yIHRoZSBuZXcgdmVyc2lvbiBvZiBCR1BzZWMuDQoNCiAgIEF0IHRoaXMgcG9pbnQgYSB0 cmFuc2l0aW9uIHdvdWxkIGJlZ2luIHdoaWNoIGlzIGFuYWxvZ291cyB0byB0aGUNCiAgIGFsZ29y aXRobSB0cmFuc2l0aW9uIGRpc2N1c3NlZCBpbiBTZWN0aW9uIDYuMS4gIER1cmluZyB0aGUgdHJh bnNpdGlvbg0KICAgcGVyaW9kIGFsbCBCR1BzZWMgc3BlYWtlcnMgU0hPVUxEIHNpbXVsdGFuZW91 c2x5IGluY2x1ZGUgYm90aCB0aGUNCiAgIEJHUHNlY19QYXRoIGF0dHJpYnV0ZSBhbmQgdGhlIG5l dyBCR1BzZWNfUEFUSF9UV08gYXR0cmlidXRlLiAgT25jZQ0KICAgdGhlIHRyYW5zaXRpb24gaXMg Y29tcGxldGUsIHRoZSB1c2Ugb2YgQkdQc2VjX1BhdGggY291bGQgdGhlbiBiZQ0KICAgZGVwcmVj YXRlZCwgYXQgd2hpY2ggcG9pbnQgQkdQc2VjIHNwZWFrZXJzIFNIT1VMRCBpbmNsdWRlIG9ubHkg dGhlDQogICBuZXcgQkdQc2VjX1BBVEhfVFdPIGF0dHJpYnV0ZS4gIFN1Y2ggYSBwcm9jZXNzIGNv dWxkIGZhY2lsaXRhdGUgYQ0KICAgdHJhbnNpdGlvbiB0byBhIG5ldyBCR1BzZWMgc2VtYW50aWNz IGluIGEgYmFja3dhcmRzIGNvbXBhdGlibGUNCiAgIGZhc2hpb24uDQoNCg0KNy4gIFNlY3VyaXR5 IENvbnNpZGVyYXRpb25zDQoNCiAgIEZvciBhIGRpc2N1c3Npb24gb2YgdGhlIEJHUHNlYyB0aHJl YXQgbW9kZWwgYW5kIHJlbGF0ZWQgc2VjdXJpdHkNCiAgIGNvbnNpZGVyYXRpb25zLCBwbGVhc2Ug c2VlIFsxNF0uDQoNCjcuMSBTZWN1cml0eSBHdWFyYW50ZWVzDQoNCiAgIFdoZW4gdXNlZCBpbiBj b25qdW5jdGlvbiB3aXRoIE9yaWdpbiBWYWxpZGF0aW9uIChzZWUgWzE5XSBhbmQgWzIwXSksDQog ICBhIEJHUHNlYyBzcGVha2VyIHdobyByZWNlaXZlcyBhIHZhbGlkIEJHUHNlYyB1cGRhdGUgbWVz c2FnZSwNCiAgIGNvbnRhaW5pbmcgYSByb3V0ZSBhZHZlcnRpc2VtZW50IGZvciBhIGdpdmVuIHBy ZWZpeCwgaXMgcHJvdmlkZWQgd2l0aA0KICAgdGhlIGZvbGxvd2luZyBzZWN1cml0eSBndWFyYW50 ZWVzOg0KDQogICBvICBUaGUgb3JpZ2luIEFTIG51bWJlciBjb3JyZXNwb25kcyB0byBhbiBhdXRv bm9tb3VzIHN5c3RlbSB0aGF0IGhhcw0KICAgICAgYmVlbiBhdXRob3JpemVkLCBpbiB0aGUgUlBL SSwgYnkgdGhlIElQIGFkZHJlc3Mgc3BhY2UgaG9sZGVyIHRvDQogICAgICBvcmlnaW5hdGUgcm91 dGUgYWR2ZXJ0aXNlbWVudHMgZm9yIHRoZSBnaXZlbiBwcmVmaXguDQogDQoNCg0KTGVwaW5za2kg ICAgICAgICAgICAgICAgICBFeHBpcmVzIE1heSA2LCAyMDE2ICAgICAgICAgICAgICAgICAgW1Bh Z2UgMjZdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgQkdQc2VjIFByb3RvY29sICAg ICAgICAgICAgIERlY2VtYmVyIDYsIDIwMTUNCg0KDQogICBvICBGb3IgZWFjaCBBUyBpbiB0aGUg cGF0aCwgYSBCR1BzZWMgc3BlYWtlciBhdXRob3JpemVkIGJ5IHRoZSBob2xkZXINCiAgICAgIG9m IHRoZSBBUyBudW1iZXIgaW50ZW50aW9uYWxseSBjaG9zZSAoaW4gYWNjb3JkYW5jZSB3aXRoIGxv Y2FsDQogICAgICBwb2xpY3kpIHRvIHByb3BhZ2F0ZSB0aGUgcm91dGUgYWR2ZXJ0aXNlbWVudCB0 byB0aGUgc3Vic2VxdWVudCBBUw0KICAgICAgaW4gdGhlIHBhdGguDQoNCiAgIFRoYXQgaXMsIHRo ZSByZWNpcGllbnQgb2YgYSB2YWxpZCBCR1BzZWMgVXBkYXRlIG1lc3NhZ2UgaXMgYXNzdXJlZA0K ICAgdGhhdCB0aGUgU2VjdXJlX1BhdGggcG9ydGlvbiBvZiB0aGUgQkdQc2VjX1BhdGggYXR0cmli dXRlIGNvcnJlc3BvbmRzDQogICB0byBhIHNlcXVlbmNlIG9mIGF1dG9ub21vdXMgc3lzdGVtcyB3 aG8gaGF2ZSBhbGwgYWdyZWVkIGluIHByaW5jaXBsZQ0KICAgdG8gZm9yd2FyZCBwYWNrZXRzIHRv IHRoZSBnaXZlbiBwcmVmaXggYWxvbmcgdGhlIGluZGljYXRlZCBwYXRoLiAgKEl0DQogICBzaG91 bGQgYmUgbm90ZWQgdGhhdCBCR1BzZWMgZG9lcyBub3Qgb2ZmZXIgYW55IGd1YXJhbnRlZSB0aGF0 IHRoZQ0KICAgZGF0YSBwYWNrZXRzIHdvdWxkIGZsb3cgYWxvbmcgdGhlIGluZGljYXRlZCBwYXRo OyBpdCBvbmx5IGd1YXJhbnRlZXMNCiAgIHRoYXQgdGhlIEJHUCB1cGRhdGUgY29udmV5aW5nIHRo ZSBwYXRoIGluZGVlZCBwcm9wYWdhdGVkIGFsb25nIHRoZQ0KICAgaW5kaWNhdGVkIHBhdGguKSAg RnVydGhlcm1vcmUsIHRoZSByZWNpcGllbnQgaXMgYXNzdXJlZCB0aGF0IHRoaXMNCiAgIHBhdGgg dGVybWluYXRlcyBpbiBhbiBhdXRvbm9tb3VzIHN5c3RlbSB0aGF0IGhhcyBiZWVuIGF1dGhvcml6 ZWQgYnkNCiAgIHRoZSBJUCBhZGRyZXNzIHNwYWNlIGhvbGRlciBhcyBhIGxlZ2l0aW1hdGUgZGVz dGluYXRpb24gZm9yIHRyYWZmaWMNCiAgIHRvIHRoZSBnaXZlbiBwcmVmaXguDQoNCiAgIE5vdGUg dGhhdCBhbHRob3VnaCBCR1BzZWMgcHJvdmlkZXMgYSBtZWNoYW5pc20gZm9yIGFuIEFTIHRvIHZh bGlkYXRlDQogICB0aGF0IGEgcmVjZWl2ZWQgdXBkYXRlIG1lc3NhZ2UgaGFzIGNlcnRhaW4gc2Vj dXJpdHkgcHJvcGVydGllcywgdGhlDQogICB1c2Ugb2Ygc3VjaCBhIG1lY2hhbmlzbSB0byBpbmZs dWVuY2Ugcm91dGUgc2VsZWN0aW9uIGlzIGNvbXBsZXRlbHkgYQ0KICAgbWF0dGVyIG9mIGxvY2Fs IHBvbGljeS4gIFRoZXJlZm9yZSwgYSBCR1BzZWMgc3BlYWtlciBjYW4gbWFrZSBubw0KICAgYXNz dW1wdGlvbnMgYWJvdXQgdGhlIHZhbGlkaXR5IG9mIGEgcm91dGUgcmVjZWl2ZWQgZnJvbSBhbiBl eHRlcm5hbA0KICAgQkdQc2VjIHBlZXIuICBUaGF0IGlzLCBhIGNvbXBsaWFudCBCR1BzZWMgcGVl ciBtYXkgKGRlcGVuZGluZyBvbiB0aGUNCiAgIGxvY2FsIHBvbGljeSBvZiB0aGUgcGVlcikgc2Vu ZCB1cGRhdGUgbWVzc2FnZXMgdGhhdCBmYWlsIHRoZSB2YWxpZGl0eQ0KICAgdGVzdCBpbiBTZWN0 aW9uIDUuICBUaHVzLCBhIEJHUHNlYyBzcGVha2VyIE1VU1QgY29tcGxldGVseSB2YWxpZGF0ZQ0K ICAgYWxsIEJHUHNlYyB1cGRhdGUgbWVzc2FnZXMgcmVjZWl2ZWQgZnJvbSBleHRlcm5hbCBwZWVy cy4gIChWYWxpZGF0aW9uDQogICBvZiB1cGRhdGUgbWVzc2FnZXMgcmVjZWl2ZWQgZnJvbSBpbnRl cm5hbCBwZWVycyBpcyBhIG1hdHRlciBvZiBsb2NhbA0KICAgcG9saWN5LCBzZWUgU2VjdGlvbiA1 KS4NCg0KNy4yIE9uIHRoZSBSZW1vdmFsIG9mIEJHUHNlYyBTaWduYXR1cmVzDQoNCiAgIFRoZXJl IG1heSBiZSBjYXNlcyB3aGVyZSBhIEJHUHNlYyBzcGVha2VyIGRlZW1zICdWYWxpZCcgKGFzIHBl ciB0aGUNCiAgIHZhbGlkYXRpb24gYWxnb3JpdGhtIGluIFNlY3Rpb24gNS4yKSBhIEJHUHNlYyB1 cGRhdGUgbWVzc2FnZSB0aGF0DQogICBjb250YWlucyBib3RoIGEgJ1ZhbGlkJyBhbmQgYSAnTm90 IFZhbGlkJyBTaWduYXR1cmVfQmxvY2suICBUaGF0IGlzLA0KICAgdGhlIHVwZGF0ZSBtZXNzYWdl IGNvbnRhaW5zIHR3byBzZXRzIG9mIHNpZ25hdHVyZXMgY29ycmVzcG9uZGluZyB0bw0KICAgdHdv IGFsZ29yaXRobSBzdWl0ZXMsIGFuZCBvbmUgc2V0IG9mIHNpZ25hdHVyZXMgdmVyaWZpZXMgY29y cmVjdGx5DQogICBhbmQgdGhlIG90aGVyIHNldCBvZiBzaWduYXR1cmVzIGZhaWxzIHRvIHZlcmlm eS4gIEluIHRoaXMgY2FzZSwgdGhlDQogICBwcm90b2NvbCBzcGVjaWZpZXMgdGhhdCBhIEJHUHNl YyBzcGVha2VyIGNob29zaW5nIHRvIHByb3BhZ2F0ZSB0aGUNCiAgIHJvdXRlIGFkdmVydGlzZW1l bnQgaW4gc3VjaCBhbiB1cGRhdGUgbWVzc2FnZSBTSE9VTEQgYWRkIGl0cw0KICAgc2lnbmF0dXJl IHRvIGVhY2ggb2YgdGhlIFNpZ25hdHVyZV9CbG9ja3MuIFRodXMgdGhlIEJHUHNlYyBzcGVha2Vy DQogICBjcmVhdGVzIGEgc2lnbmF0dXJlIHVzaW5nIGJvdGggYWxnb3JpdGhtIHN1aXRlcyBhbmQg Y3JlYXRlcyBhIG5ldw0KICAgdXBkYXRlIG1lc3NhZ2UgdGhhdCBjb250YWlucyBib3RoIHRoZSAn VmFsaWQnIGFuZCB0aGUgJ05vdCBWYWxpZCcgc2V0DQogICBvZiBzaWduYXR1cmVzIChmcm9tIGl0 cyBvd24gdmFudGFnZSBwb2ludCkuDQoNCiAgIFRvIHVuZGVyc3RhbmQgdGhlIHJlYXNvbiBmb3Ig c3VjaCBhIGRlc2lnbiBkZWNpc2lvbiBjb25zaWRlciB0aGUgY2FzZQ0KICAgd2hlcmUgdGhlIEJH UHNlYyBzcGVha2VyIHJlY2VpdmVzIGFuIHVwZGF0ZSBtZXNzYWdlIHdpdGggYm90aCBhIHNldA0K ICAgb2YgYWxnb3JpdGhtIEEgc2lnbmF0dXJlcyB3aGljaCBhcmUgJ1ZhbGlkJyBhbmQgYSBzZXQg b2YgYWxnb3JpdGhtIEINCiAgIHNpZ25hdHVyZXMgd2hpY2ggYXJlICdOb3QgVmFsaWQnLiAgSW4g c3VjaCBhIGNhc2UgaXQgaXMgcG9zc2libGUNCiANCg0KDQpMZXBpbnNraSAgICAgICAgICAgICAg ICAgIEV4cGlyZXMgTWF5IDYsIDIwMTYgICAgICAgICAgICAgICAgICBbUGFnZSAyN10NCgwNCklu dGVybmV0LURyYWZ0ICAgICAgICAgICAgICBCR1BzZWMgUHJvdG9jb2wgICAgICAgICAgICAgRGVj ZW1iZXIgNiwgMjAxNQ0KDQoNCiAgIChwZXJoYXBzIGV2ZW4gbGlrZWx5LCBkZXBlbmRpbmcgb24g dGhlIHN0YXRlIG9mIHRoZSBhbGdvcml0aG0NCiAgIHRyYW5zaXRpb24pIHRoYXQgc29tZSBvZiB0 aGUgQkdQc2VjIHNwZWFrZXIncyBwZWVycyAob3Igb3RoZXINCiAgIGVudGl0aWVzIGZ1cnRoZXIg J2Rvd25zdHJlYW0nIGluIHRoZSBCR1AgdG9wb2xvZ3kpIGRvIG5vdCBzdXBwb3J0DQogICBhbGdv cml0aG0gQS4gVGhlcmVmb3JlLCBpZiB0aGUgQkdQc2VjIHNwZWFrZXIgd2VyZSB0byByZW1vdmUg dGhlICdOb3QNCiAgIFZhbGlkJyBzZXQgb2Ygc2lnbmF0dXJlcyBjb3JyZXNwb25kaW5nIHRvIGFs Z29yaXRobSBCLCBzdWNoIGVudGl0aWVzDQogICB3b3VsZCB0cmVhdCB0aGUgbWVzc2FnZSBhcyB0 aG91Z2ggaXQgd2VyZSB1bnNpZ25lZC4gIEJ5IGluY2x1ZGluZyB0aGUNCiAgICdOb3QgVmFsaWQn IHNldCBvZiBzaWduYXR1cmVzIHdoZW4gcHJvcGFnYXRpbmcgYSByb3V0ZSBhZHZlcnRpc2VtZW50 LA0KICAgdGhlIEJHUHNlYyBzcGVha2VyIGVuc3VyZXMgdGhhdCAnZG93bnN0cmVhbScgZW50aXRp ZXMgaGF2ZSBhcyBtdWNoDQogICBpbmZvcm1hdGlvbiBhcyBwb3NzaWJsZSB0byBtYWtlIGFuIGlu Zm9ybWVkIG9waW5pb24gYWJvdXQgdGhlDQogICB2YWxpZGF0aW9uIHN0YXR1cyBvZiBhIEJHUHNl YyB1cGRhdGUuDQoNCiAgIE5vdGUgYWxzbyB0aGF0IGR1cmluZyBhIHBlcmlvZCBvZiBwYXJ0aWFs IEJHUHNlYyBkZXBsb3ltZW50LCBhDQogICAnZG93bnN0cmVhbScgZW50aXR5IG1pZ2h0IHJlYXNv bmFibHkgdHJlYXQgdW5zaWduZWQgbWVzc2FnZXMNCiAgIGRpZmZlcmVudGx5IGZyb20gQkdQc2Vj IHVwZGF0ZXMgdGhhdCBjb250YWluIGEgc2luZ2xlIHNldCBvZiAnTm90DQogICBWYWxpZCcgc2ln bmF0dXJlcy4gIFRoYXQgaXMsIGJ5IHJlbW92aW5nIHRoZSBzZXQgb2YgJ05vdCBWYWxpZCcNCiAg IHNpZ25hdHVyZXMgdGhlIEJHUHNlYyBzcGVha2VyIG1pZ2h0IGFjdHVhbGx5IGNhdXNlIGEgZG93 bnN0cmVhbQ0KICAgZW50aXR5IHRvICd1cGdyYWRlJyB0aGUgc3RhdHVzIG9mIGEgcm91dGUgYWR2 ZXJ0aXNlbWVudCBmcm9tICdOb3QNCiAgIFZhbGlkJyB0byB1bnNpZ25lZC4gIEZpbmFsbHksIG5v dGUgdGhhdCBpbiB0aGUgYWJvdmUgc2NlbmFyaW8sIHRoZQ0KICAgQkdQc2VjIHNwZWFrZXIgbWln aHQgaGF2ZSBkZWVtZWQgYWxnb3JpdGhtIEEgc2lnbmF0dXJlcyAnVmFsaWQnIG9ubHkNCiAgIGJl Y2F1c2Ugb2Ygc29tZSBpc3N1ZSB3aXRoIFJQS0kgc3RhdGUgbG9jYWwgdG8gaGlzIEFTIChmb3Ig ZXhhbXBsZSwNCiAgIGhpcyBBUyBtaWdodCBub3QgeWV0IGhhdmUgb2J0YWluZWQgYSBDUkwgaW5k aWNhdGluZyB0aGF0IGEga2V5IHVzZWQNCiAgIHRvIHZlcmlmeSBhbiBhbGdvcml0aG0gQSBzaWdu YXR1cmUgYmVsb25ncyB0byBhIG5ld2x5IHJldm9rZWQNCiAgIGNlcnRpZmljYXRlKS4gIEluIHN1 Y2ggYSBjYXNlLCBpdCBpcyBoaWdobHkgZGVzaXJhYmxlIGZvciBhDQogICBkb3duc3RyZWFtIGVu dGl0eSB0byB0cmVhdCB0aGUgdXBkYXRlIGFzICdOb3QgVmFsaWQnIChkdWUgdG8gdGhlDQogICBy ZXZvY2F0aW9uKSBhbmQgbm90IGFzICd1bnNpZ25lZCcgKHdoaWNoIHdvdWxkIGhhcHBlbiBpZiB0 aGUgJ05vdA0KICAgVmFsaWQnIFNpZ25hdHVyZV9CbG9ja3Mgd2VyZSByZW1vdmVkKS4NCg0KICAg QSBzaW1pbGFyIGFyZ3VtZW50IGFwcGxpZXMgdG8gdGhlIGNhc2Ugd2hlcmUgYSBCR1BzZWMgc3Bl YWtlciAoZm9yDQogICBzb21lIHJlYXNvbiBzdWNoIGFzIGxhY2sgb2YgdmlhYmxlIGFsdGVybmF0 aXZlcykgc2VsZWN0cyBhcyBoaXMgYmVzdA0KICAgcGF0aCAodG8gYSBnaXZlbiBwcmVmaXgpIGEg cm91dGUgb2J0YWluZWQgdmlhIGEgJ05vdCBWYWxpZCcgQkdQc2VjDQogICB1cGRhdGUgbWVzc2Fn ZS4gSW4gc3VjaCBhIGNhc2UsIHRoZSBCR1BzZWMgc3BlYWtlciBzaG91bGQgcHJvcGFnYXRlIGEN CiAgIHNpZ25lZCBCR1BzZWMgdXBkYXRlIG1lc3NhZ2UsIGFkZGluZyBoaXMgc2lnbmF0dXJlIHRv IHRoZSAnTm90IFZhbGlkJw0KICAgc2lnbmF0dXJlcyB0aGF0IGFscmVhZHkgZXhpc3QuICBBZ2Fp biwgdGhpcyBpcyB0byBlbnN1cmUgdGhhdA0KICAgJ2Rvd25zdHJlYW0nIGVudGl0aWVzIGFyZSBh YmxlIHRvIG1ha2UgYW4gaW5mb3JtZWQgZGVjaXNpb24gYW5kIG5vdA0KICAgZXJyb25lb3VzbHkg dHJlYXQgdGhlIHJvdXRlIGFzIHVuc2lnbmVkLiAgSXQgc2hvdWxkIGFsc28gYmUgbm90ZWQNCiAg IHRoYXQgZHVlIHRvIHBvc3NpYmxlIGRpZmZlcmVuY2VzIGluIFJQS0kgZGF0YSBvYnNlcnZlZCBh dCBkaWZmZXJlbnQNCiAgIHZhbnRhZ2UgcG9pbnRzIGluIHRoZSBuZXR3b3JrLCBhIEJHUHNlYyB1 cGRhdGUgZGVlbWVkICdOb3QgVmFsaWQnIGF0DQogICBhbiB1cHN0cmVhbSBCR1BzZWMgc3BlYWtl ciBtYXkgYmUgZGVlbWVkICdWYWxpZCcgYnkgYW5vdGhlciBCR1ANCiAgIHNwZWFrZXIgZG93bnN0 cmVhbS4NCg0KICAgSW5kZWVkLCB3aGVuIGEgQkdQc2VjIHNwZWFrZXIgc2lnbnMgYW4gb3V0Z29p bmcgdXBkYXRlIG1lc3NhZ2UsIGl0IGlzDQogICBub3QgYXR0ZXN0aW5nIHRvIGEgYmVsaWVmIHRo YXQgYWxsIHNpZ25hdHVyZXMgcHJpb3IgdG8gaXRzIGFyZSB2YWxpZC4NCiAgICBJbnN0ZWFkIGl0 IGlzIG1lcmVseSBhc3NlcnRpbmcgdGhhdDoNCg0KICAgbyAgVGhlIEJHUHNlYyBzcGVha2VyIHJl Y2VpdmVkIHRoZSBnaXZlbiByb3V0ZSBhZHZlcnRpc2VtZW50IHdpdGggdGhlDQogICAgICBpbmRp Y2F0ZWQgTkxSSSBhbmQgU2VjdXJlX1BhdGg7IGFuZA0KDQogICBvICBUaGUgQkdQc2VjIHNwZWFr ZXIgY2hvc2UgdG8gcHJvcGFnYXRlIGFuIGFkdmVydGlzZW1lbnQgZm9yIHRoaXMNCiANCg0KDQpM ZXBpbnNraSAgICAgICAgICAgICAgICAgIEV4cGlyZXMgTWF5IDYsIDIwMTYgICAgICAgICAgICAg ICAgICBbUGFnZSAyOF0NCgwNCkludGVybmV0LURyYWZ0ICAgICAgICAgICAgICBCR1BzZWMgUHJv dG9jb2wgICAgICAgICAgICAgRGVjZW1iZXIgNiwgMjAxNQ0KDQoNCiAgICAgIHJvdXRlIHRvIHRo ZSBwZWVyIChpbXBsaWNpdGx5KSBpbmRpY2F0ZWQgYnkgdGhlICdUYXJnZXQgQVMnDQoNCjcuMyBN aXRpZ2F0aW9uIG9mIERlbmlhbCBvZiBTZXJ2aWNlIEF0dGFja3MNCg0KICAgVGhlIEJHUHNlYyB1 cGRhdGUgdmFsaWRhdGlvbiBwcm9jZWR1cmUgaXMgYSBwb3RlbnRpYWwgdGFyZ2V0IGZvcg0KICAg ZGVuaWFsIG9mIHNlcnZpY2UgYXR0YWNrcyBhZ2FpbnN0IGEgQkdQc2VjIHNwZWFrZXIuIEhlcmUg d2UgY29uc2lkZXINCiAgIHRoZSBtaXRpZ2F0aW9uIG9ubHkgb2YgZGVuaWFsIG9mIHNlcnZpY2Ug YXR0YWNrcyB0aGF0IGFyZSBzcGVjaWZpYyB0bw0KICAgQkdQc2VjLg0KDQogICBUbyBtaXRpZ2F0 ZSB0aGUgZWZmZWN0aXZlbmVzcyBvZiBzdWNoIGRlbmlhbCBvZiBzZXJ2aWNlIGF0dGFja3MsDQog ICBCR1BzZWMgc3BlYWtlcnMgc2hvdWxkIGltcGxlbWVudCBhbiB1cGRhdGUgdmFsaWRhdGlvbiBh bGdvcml0aG0gdGhhdA0KICAgcGVyZm9ybXMgZXhwZW5zaXZlIGNoZWNrcyAoZS5nLiwgc2lnbmF0 dXJlIHZlcmlmaWNhdGlvbikgYWZ0ZXINCiAgIHBlcmZvcm1pbmcgbGVzcyBleHBlbnNpdmUgY2hl Y2tzIChlLmcuLCBzeW50YXggY2hlY2tzKS4gIFRoZQ0KICAgdmFsaWRhdGlvbiBhbGdvcml0aG0g c3BlY2lmaWVkIGluIFNlY3Rpb24gNS4yIHdhcyBjaG9zZW4gc28gYXMgdG8NCiAgIHBlcmZvcm0g Y2hlY2tzIHdoaWNoIGFyZSBsaWtlbHkgdG8gYmUgZXhwZW5zaXZlIGFmdGVyIGNoZWNrcyB0aGF0 IGFyZQ0KICAgbGlrZWx5IHRvIGJlIGluZXhwZW5zaXZlLiAgSG93ZXZlciwgdGhlIHJlbGF0aXZl IGNvc3Qgb2YgcGVyZm9ybWluZw0KICAgcmVxdWlyZWQgdmFsaWRhdGlvbiBzdGVwcyBtYXkgdmFy eSBiZXR3ZWVuIGltcGxlbWVudGF0aW9ucywgYW5kIHRodXMNCiAgIHRoZSBhbGdvcml0aG0gc3Bl Y2lmaWVkIGluIFNlY3Rpb24gNS4yIG1heSBub3QgcHJvdmlkZSB0aGUgYmVzdA0KICAgZGVuaWFs IG9mIHNlcnZpY2UgcHJvdGVjdGlvbiBmb3IgYWxsIGltcGxlbWVudGF0aW9ucy4NCg0KICAgQWRk aXRpb25hbGx5LCBzZW5kaW5nIHVwZGF0ZSBtZXNzYWdlcyB3aXRoIHZlcnkgbG9uZyBBUyBwYXRo cyAoYW5kDQogICBoZW5jZSBhIGxhcmdlIG51bWJlciBvZiBzaWduYXR1cmVzKSBpcyBhIHBvdGVu dGlhbCBtZWNoYW5pc20gdG8NCiAgIGNvbmR1Y3QgZGVuaWFsIG9mIHNlcnZpY2UgYXR0YWNrcy4g Rm9yIHRoaXMgcmVhc29uLCBpdCBpcyBpbXBvcnRhbnQNCiAgIHRoYXQgYW4gaW1wbGVtZW50YXRp b24gb2YgdGhlIHZhbGlkYXRpb24gYWxnb3JpdGhtIHN0b3BzIGF0dGVtcHRpbmcNCiAgIHRvIHZl cmlmeSBzaWduYXR1cmVzIGFzIHNvb24gYXMgYW4gaW52YWxpZCBzaWduYXR1cmUgaXMgZm91bmQu IChUaGlzDQogICBlbnN1cmVzIHRoYXQgbG9uZyBzZXF1ZW5jZXMgb2YgaW52YWxpZCBzaWduYXR1 cmVzIGNhbm5vdCBiZSB1c2VkIGZvcg0KICAgZGVuaWFsIG9mIHNlcnZpY2UgYXR0YWNrcy4pIEZ1 cnRoZXJtb3JlLCBpbXBsZW1lbnRhdGlvbnMgY2FuIG1pdGlnYXRlDQogICBzdWNoIGF0dGFja3Mg Ynkgb25seSBwZXJmb3JtaW5nIHZhbGlkYXRpb24gb24gdXBkYXRlIG1lc3NhZ2VzIHRoYXQsDQog ICBpZiB2YWxpZCwgd291bGQgYmUgc2VsZWN0ZWQgYXMgdGhlIGJlc3QgcGF0aC4gVGhhdCBpcywg aWYgYW4gdXBkYXRlDQogICBtZXNzYWdlIGNvbnRhaW5zIGEgcm91dGUgdGhhdCB3b3VsZCBsb3Nl IG91dCBpbiBiZXN0IHBhdGggc2VsZWN0aW9uDQogICBmb3Igb3RoZXIgcmVhc29ucyAoZS5nLiwg YSB2ZXJ5IGxvbmcgQVMgcGF0aCkgdGhlbiBpdCBpcyBub3QNCiAgIG5lY2Vzc2FyeSB0byBkZXRl cm1pbmUgdGhlIEJHUHNlYy12YWxpZGl0eSBzdGF0dXMgb2YgdGhlIHJvdXRlLg0KDQo3LjQgQWRk aXRpb25hbCBTZWN1cml0eSBDb25zaWRlcmF0aW9ucw0KDQogICBUaGUgbWVjaGFuaXNtIG9mIHNl dHRpbmcgdGhlIHBDb3VudCBmaWVsZCB0byB6ZXJvIGlzIGluY2x1ZGVkIGluIHRoaXMNCiAgIHNw ZWNpZmljYXRpb24gdG8gZW5hYmxlIHJvdXRlIHNlcnZlcnMgaW4gdGhlIGNvbnRyb2wgcGF0aCB0 bw0KICAgcGFydGljaXBhdGUgaW4gQkdQc2VjIHdpdGhvdXQgaW5jcmVhc2luZyB0aGUgZWZmZWN0 aXZlIGxlbmd0aCBvZiB0aGUNCiAgIEFTLVBBVEguICBIb3dldmVyLCBlbnRpdGllcyBvdGhlciB0 aGFuIHJvdXRlIHNlcnZlcnMgY291bGQNCiAgIGNvbmNlaXZhYmx5IHVzZSB0aGlzIG1lY2hhbmlz bSAoc2V0IHRoZSBwQ291bnQgdG8gemVybykgdG8gYXR0cmFjdA0KICAgdHJhZmZpYyAoYnkgcmVk dWNpbmcgdGhlIGVmZmVjdGl2ZSBsZW5ndGggb2YgdGhlIEFTLVBBVEgpDQogICBpbGxlZ2l0aW1h dGVseS4gIFRoaXMgcmlzayBpcyBsYXJnZWx5IG1pdGlnYXRlZCBpZiBldmVyeSBCR1BzZWMNCiAg IHNwZWFrZXIgZHJvcHMgaW5jb21pbmcgdXBkYXRlIG1lc3NhZ2VzIHRoYXQgc2V0IHBDb3VudCB0 byB6ZXJvIGJ1dA0KICAgY29tZSBmcm9tIGEgcGVlciB0aGF0IGlzIG5vdCBhIHJvdXRlIHNlcnZl ci4gIEhvd2V2ZXIsIG5vdGUgdGhhdCBhDQogICByZWNpcGllbnQgb2YgYSBCR1BzZWMgdXBkYXRl IG1lc3NhZ2Ugd2l0aGluIHdoaWNoIGFuIHVwc3RyZWFtIGVudGl0eQ0KICAgdHdvIG9yIG1vcmUg aG9wcyBhd2F5IGhhcyBzZXQgcENvdW50IHRvIHplcm8gaXMgdW5hYmxlIHRvIHZlcmlmeSBmb3IN CiAgIHRoZW1zZWx2ZXMgd2hldGhlciBwQ291bnQgd2FzIHNldCB0byB6ZXJvIGxlZ2l0aW1hdGVs eS4NCg0KIA0KDQoNCkxlcGluc2tpICAgICAgICAgICAgICAgICAgRXhwaXJlcyBNYXkgNiwgMjAx NiAgICAgICAgICAgICAgICAgIFtQYWdlIDI5XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgICAgICAg ICAgIEJHUHNlYyBQcm90b2NvbCAgICAgICAgICAgICBEZWNlbWJlciA2LCAyMDE1DQoNCg0KICAg QkdQc2VjIGRvZXMgbm90IHByb3ZpZGUgcHJvdGVjdGlvbiBhZ2FpbnN0IGF0dGFja3MgYXQgdGhl IHRyYW5zcG9ydA0KICAgbGF5ZXIuICBBcyB3aXRoIGFueSBCR1Agc2Vzc2lvbiwgYW4gYWR2ZXJz YXJ5IG9uIHRoZSBwYXRoIGJldHdlZW4gYQ0KICAgQkdQc2VjIHNwZWFrZXIgYW5kIGl0cyBwZWVy IGlzIGFibGUgdG8gcGVyZm9ybSBhdHRhY2tzIHN1Y2ggYXMNCiAgIG1vZGlmeWluZyB2YWxpZCBC R1BzZWMgdXBkYXRlcyB0byBjYXVzZSB0aGVtIHRvIGZhaWwgdmFsaWRhdGlvbiwNCiAgIGluamVj dGluZyAodW5zaWduZWQpIEJHUCB1cGRhdGUgbWVzc2FnZXMgd2l0aG91dA0KICAgQkdQc2VjX1Bh dGhfU2lnbmF0dXJlIGF0dHJpYnV0ZXMsIGluamVjdGluZyBCR1BzZWMgdXBkYXRlIG1lc3NhZ2Vz DQogICB3aXRoIEJHUHNlY19QYXRoX1NpZ25hdHVyZSBhdHRyaWJ1dGVzIHRoYXQgZmFpbCB2YWxp ZGF0aW9uLCBvcg0KICAgY2F1c2luZyB0aGUgcGVlciB0byB0ZWFyLWRvd24gdGhlIEJHUCBzZXNz aW9uLiBUaGUgdXNlIG9mIEJHUHNlYyBkb2VzDQogICBub3RoaW5nIHRvIGluY3JlYXNlIHRoZSBw b3dlciBvZiBhbiBvbi1wYXRoIGFkdmVyc2FyeSAtLSBpbg0KICAgcGFydGljdWxhciwgZXZlbiBh biBvbi1wYXRoIGFkdmVyc2FyeSBjYW5ub3QgY2F1c2UgYSBCR1BzZWMgc3BlYWtlcg0KICAgdG8g YmVsaWV2ZSBhIEJHUHNlYy1pbnZhbGlkIHJvdXRlIGlzIHZhbGlkLiBIb3dldmVyLCBhcyB3aXRo IGFueSBCR1ANCiAgIHNlc3Npb24sIEJHUHNlYyBzZXNzaW9ucyBTSE9VTEQgYmUgcHJvdGVjdGVk IGJ5IGFwcHJvcHJpYXRlIHRyYW5zcG9ydA0KICAgc2VjdXJpdHkgbWVjaGFuaXNtcy4NCg0KICAg T25lIG1pZ2h0IGJlIGNvbmNlcm5lZCBhYm91dCBhIHBvdGVudGlhbCBhdHRhY2sgaW4gd2hpY2gg YW4gYWR2ZXJzYXJ5DQogICByZXBsYXlzIGEgdmFsaWQgc2lnbmF0dXJlIG9uIGFuIG9yaWdpbiBT ZWN1cmVfUGF0aCBzZWdtZW50IGFzIHRob3VnaA0KICAgaXQgd2VyZSBhIHNpZ25hdHVyZSBvbiBs YXRlciBTZWN1cmVfUGF0aCBzZWdtZW50IChpbiBhIGRpZmZlcmVudA0KICAgdXBkYXRlIG1lc3Nh Z2UpLiBUaGUgb25seSB3YXkgc3VjaCBhbiBhdHRhY2sgY291bGQgc3VjY2VlZCB3b3VsZCBiZQ0K ICAgaWYgYSBzdHJ1Y3R1cmUgb2YgYml0cyB0byBiZSBzaWduZWQgaW4gU2VjdGlvbiA0LjEgKG9y aWdpbiBzZWdtZW50KQ0KICAgY291bGQgYWxzbyBiZSBwYXJzZWQgYXMgYSB2YWxpZCBzZXF1ZW5j ZSBvZiBiaXRzIHRvIGJlIHNpZ25lZCBpbg0KICAgU2VjdGlvbiA0LjIgKGxhdGVyIHNlZ21lbnQp LiBUaGlzLCBpbiBwYXJ0aWN1bGFyLCB3b3VsZCByZXF1aXJlIHRoYXQNCiAgIHRoZSBsZW5ndGgg b2YgdGhlIHR3byBzdHJ1Y3R1cmVzIG1hdGNoIGV4YWN0bHksIHdoaWNoIGNhbm5vdCBoYXBwZW4N CiAgIGdpdmVuIHRoZSBjdXJyZW50IGNob2ljZSBvZiBhbGdvcml0aG1zIGluIFsxMF0uIFdlIGRv IG5vdCBleHBlY3QgdGhpcw0KICAgdG8gYmUgYSBwcm9ibGVtIHdpdGggZnV0dXJlIHNpZ25hdHVy ZSBhbGdvcml0aG1zLCBhcyBpdCBpcyBsaWtlbHkNCiAgIHRoYXQgc2lnbmF0dXJlcyB3aWxsIGdl dCBsb25nZXIgKGluc3RlYWQgb2Ygc2hvcnRlcikgb3ZlciB0aW1lLg0KICAgSG93ZXZlciwgYXV0 aG9ycyBvZiBmdXR1cmUgcmV2aXNpb25zIG9mIHRoZSBhbGdvcml0aG1zIGRvY3VtZW50IFsxMF0N CiAgIHNob3VsZCB0YWtlIGNhcmUgdG8gZW5zdXJlIHRoYXQgdGhpcyBhdHRhY2sgcmVtYWlucyBp bmZlYXNpYmxlLg0KDQo4LiAgSUFOQSBDb25zaWRlcmF0aW9ucw0KDQogICBUaGlzIGRvY3VtZW50 IHJlZ2lzdGVycyBhIG5ldyBjYXBhYmlsaXR5IGluIHRoZSByZWdpc3RyeSBvZiBCR1ANCiAgIENh cGFiaWxpdGllcy4gVGhlIGRlc2NyaXB0aW9uIGZvciB0aGUgbmV3IGNhcGFiaWxpdHkgaXMgIkJH UHNlYw0KICAgQ2FwYWJpbGl0eSIuIFRoZSByZWZlcmVuY2UgZm9yIHRoZSBuZXcgY2FwYWJpbGl0 eSBpcyB0aGlzIGRvY3VtZW50DQogICAoaS5lLiwgdGhlIFJGQyB0aGF0IHJlcGxhY2VzIGRyYWZ0 LWlldGYtc2lkci1iZ3BzZWMtcHJvdG9jb2wpLg0KDQogICBUaGlzIGRvY3VtZW50IHJlZ2lzdGVy cyBhIG5ldyBwYXRoIGF0dHJpYnV0ZSBpbiB0aGUgcmVnaXN0cnkgb2YgQkdQDQogICBQYXRoIEF0 dHJpYnV0ZXMuIFRoZSBjb2RlIGZvciB0aGlzIG5ldyBhdHRyaWJ1dGUgaXMgIkJHUHNlY19QQVRI Ii4NCiAgIFRoZSByZWZlcmVuY2UgZm9yIHRoZSBuZXcgY2FwYWJpbGl0eSBpcyB0aGlzIGRvY3Vt ZW50IChpLmUuLCB0aGUgUkZDDQogICB0aGF0IHJlcGxhY2VzIGRyYWZ0LWlldGYtc2lkci1iZ3Bz ZWMtcHJvdG9jb2wpLiAgDQoNCiAgIFRoaXMgZG9jdW1lbnQgZG9lcyBub3QgY3JlYXRlIGFueSBu ZXcgSUFOQSByZWdpc3RyaWVzLg0KDQo5LiAgQ29udHJpYnV0b3JzDQoNCjkuMS4gIEF1dGhvcnMN Cg0KICAgUm9iIEF1c3RlaW4NCiAgIERyYWdvbiBSZXNlYXJjaCBMYWJzDQogDQoNCg0KTGVwaW5z a2kgICAgICAgICAgICAgICAgICBFeHBpcmVzIE1heSA2LCAyMDE2ICAgICAgICAgICAgICAgICAg W1BhZ2UgMzBdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgQkdQc2VjIFByb3RvY29s ICAgICAgICAgICAgIERlY2VtYmVyIDYsIDIwMTUNCg0KDQogICBzcmFAaGFjdHJuLm5ldA0KDQog ICBTdGV2ZW4gQmVsbG92aW4NCiAgIENvbHVtYmlhIFVuaXZlcnNpdHkNCiAgIHNtYkBjcy5jb2x1 bWJpYS5lZHUNCg0KICAgUmFuZHkgQnVzaA0KICAgSW50ZXJuZXQgSW5pdGlhdGl2ZSBKYXBhbg0K ICAgcmFuZHlAcHNnLmNvbQ0KDQogICBSdXNzIEhvdXNsZXkNCiAgIFZpZ2lsIFNlY3VyaXR5DQog ICBob3VzbGV5QHZpZ2lsc2VjLmNvbQ0KDQogICBNYXR0IExlcGluc2tpDQogICBOZXcgQ29sbGVn ZSBvZiBGbG9yaWRhDQogICBtbGVwaW5za2lAbmNmLmVkdQ0KDQogICBTdGVwaGVuIEtlbnQNCiAg IEJCTiBUZWNobm9sb2dpZXMNCiAgIGtlbnRAYmJuLmNvbQ0KDQogICBXYXJyZW4gS3VtYXJpDQog ICBHb29nbGUNCiAgIHdhcnJlbkBrdW1hcmkubmV0DQoNCiAgIERvdWcgTW9udGdvbWVyeQ0KICAg VVNBIE5hdGlvbmFsIEluc3RpdHV0ZSBvZiBTdGFuZGFyZHMgYW5kIFRlY2hub2xvZ3kNCiAgIGRv dWdtQG5pc3QuZ292DQoNCiAgIEtvdGlrYWxhcHVkaSBTcmlyYW0NCiAgIFVTQSBOYXRpb25hbCBJ bnN0aXR1dGUgb2YgU3RhbmRhcmRzIGFuZCBUZWNobm9sb2d5DQogICBrb3Rpa2FsYXB1ZGkuc3Jp cmFtQG5pc3QuZ292DQoNCiAgIFNhbXVlbCBXZWlsZXINCiAgIFBhcnNvbnMNCiAgIHdlaWxlcitp ZXRmQHdhdHNvbi5vcmcNCg0KOS4yLiAgQWNrbm93bGVkZ2VtZW50cw0KDQogICBUaGUgYXV0aG9y cyB3b3VsZCBsaWtlIHRvIHRoYW5rIE1pY2hhZWwgQmFlciwgTHVrZSBCZXJuZHQsIFNoYXJvbg0K ICAgR29sZGJlcmcsIEVkIEtlcm4sIERhdmlkIE1hbmRlbGJlcmcsIERvdWcgTWF1Z2hhbiwgUHJh ZG9zaCBNb2hhcGF0cmEsDQogICBDaHJpcyBNb3Jyb3csIFJ1c3MgTXVuZHksIFNhbmR5IE11cnBo eSwgS2V5dXIgUGF0ZWwsIE1hcmsgUmV5bm9sZHMsDQogICBIZWF0aGVyIFNjaGlsbGVyLCBKYXNv biBTY2hpbGxlciwgSm9obiBTY3VkZGVyLCBSdWVkaWdlciBWb2xrIGFuZA0KICAgRGF2aWQgV2Fy ZCBmb3IgdGhlaXIgdmFsdWFibGUgaW5wdXQgYW5kIHJldmlldy4NCg0KDQoxMC4gIE5vcm1hdGl2 ZSBSZWZlcmVuY2VzDQogDQoNCg0KTGVwaW5za2kgICAgICAgICAgICAgICAgICBFeHBpcmVzIE1h eSA2LCAyMDE2ICAgICAgICAgICAgICAgICAgW1BhZ2UgMzFdDQoMDQpJbnRlcm5ldC1EcmFmdCAg ICAgICAgICAgICAgQkdQc2VjIFByb3RvY29sICAgICAgICAgICAgIERlY2VtYmVyIDYsIDIwMTUN Cg0KDQogICBbMV0gICBCcmFkbmVyLCBTLiwgIktleSB3b3JkcyBmb3IgdXNlIGluIFJGQ3MgdG8g SW5kaWNhdGUgUmVxdWlyZW1lbnQNCiAgICAgICAgIExldmVscyIsIEJDUCAxNCwgUkZDIDIxMTks IE1hcmNoIDE5OTcuDQoNCiAgIFsyXSAgIFJla2h0ZXIsIFkuLCBFZC4sIExpLCBULiwgRWQuLCBh bmQgUy4gSGFyZXMsIEVkLiwgIkEgQm9yZGVyDQogICAgICAgICBHYXRld2F5IFByb3RvY29sIDQi LCBSRkMgNDI3MSwgSmFudWFyeSAyMDA2Lg0KDQogICBbM10gICBCYXRlcywgVC4sIENoYW5kcmEs IFIuLCBLYXR6LCBELiwgYW5kIFkuIFJla2h0ZXIsDQogICAgICAgICAiTXVsdGlwcm90b2NvbCBF eHRlbnNpb25zIGZvciBCR1AtNCIsIFJGQyA0NzYwLCBKYW51YXJ5IDIwMDcuDQoNCiAgIFs0XSAg IFZvaHJhLCBRLiBhbmQgRS4gQ2hlbiwgIkJHUCBTdXBwb3J0IGZvciBGb3VyLW9jdGV0IEFTIE51 bWJlcg0KICAgICAgICAgU3BhY2UiLCBSRkMgNjc5MywgRGVjZW1iZXIgMjAxMi4NCg0KICAgWzVd ICAgVHJhaW5hLCBQLiwgTWNQaGVyc29uLCBELiwgYW5kIEouIFNjdWRkZXIsICJBdXRvbm9tb3Vz IFN5c3RlbQ0KICAgICAgICAgQ29uZmVkZXJhdGlvbnMgZm9yIEJHUCIsIFJGQyA1MDY1LCBBdWd1 c3QgMjAwNy4NCg0KICAgWzZdICAgU2N1ZGRlciwgSi4gYW5kIFIuIENoYW5kcmEsICJDYXBhYmls aXRpZXMgQWR2ZXJ0aXNlbWVudCB3aXRoDQogICAgICAgICBCR1AtNCIsIFJGQyA1NDkyLCBGZWJy dWFyeSAyMDA5Lg0KDQogICBbN10gICBMZXBpbnNraSwgTS4sIEtlbnQsIFMuLCBhbmQgRC4gS29u ZywgIkEgUHJvZmlsZSBmb3IgUm91dGUNCiAgICAgICAgIE9yaWdpbiBBdXRob3JpemF0aW9ucyAo Uk9BcykiLCBSRkMgNjQ4MiwgRmVicnVhcnkgMjAxMi4NCg0KICAgWzhdICAgUGF0ZWwsIEsuLCBX YXJkLCBELiwgYW5kIFIuIEJ1c2gsICJFeHRlbmRlZCBNZXNzYWdlIHN1cHBvcnQgZm9yDQogICAg ICAgICBCR1AiLCBkcmFmdC1pZXRmLWlkci1iZ3AtZXh0ZW5kZWQtbWVzc2FnZXMgKHdvcmsgaW4g cHJvZ3Jlc3MpLA0KICAgICAgICAgSmFudWFyeSAyMDE1Lg0KDQogICBbOV0gIFJleW5vbGRzLCBN LiwgVHVybmVyLCBTLiwgYW5kIFMuIEtlbnQsICJBIFByb2ZpbGUgZm9yIEJHUHNlYw0KICAgICAg ICAgUm91dGVyIENlcnRpZmljYXRlcywgQ2VydGlmaWNhdGUgUmV2b2NhdGlvbiBMaXN0cywgYW5k DQogICAgICAgICBDZXJ0aWZpY2F0aW9uIFJlcXVlc3RzIiwgZHJhZnQtaWV0Zi1zaWRyLWJncHNl Yy1wa2ktcHJvZmlsZXMNCiAgICAgICAgICh3b3JrIGluIHByb2dyZXNzKSwgTm92ZW1iZXIgMjAx NC4NCg0KICAgWzEwXSAgVHVybmVyLCBTLiwgIkJHUCBBbGdvcml0aG1zLCBLZXkgRm9ybWF0cywg JiBTaWduYXR1cmUgRm9ybWF0cyIsDQogICAgICAgICBkcmFmdC1pZXRmLXNpZHItYmdwc2VjLWFs Z3MgKHdvcmsgaW4gcHJvZ3Jlc3MpLCBKdWx5IDIwMTQuDQoNCiAgIFsxMV0gIFNjdWRkZXIsIEou LCBDaGVuLCBFLiwgTW9oYXBhdHJhLCBQLiwgYW5kIEsuIFBhdGVsLCAiUmV2aXNlZA0KICAgICAg ICAgRXJyb3IgSGFuZGxpbmcgZm9yIEJHUCBVUERBVEUgTWVzc2FnZXMiLCBkcmFmdC1pZXRmLWlk ci1lcnJvci0NCiAgICAgICAgIGhhbmRsaW5nICh3b3JrIGluIHByb2dyZXNzKSwgRGVjZW1iZXIg MjAxNC4NCg0KMTEuICBJbmZvcm1hdGl2ZSBSZWZlcmVuY2VzDQoNCiAgIFsxMl0gICBMZXBpbnNr aSwgTS4gYW5kIFMuIEtlbnQsICJBbiBJbmZyYXN0cnVjdHVyZSB0byBTdXBwb3J0IFNlY3VyZQ0K ICAgICAgICAgSW50ZXJuZXQgUm91dGluZyIsIFJGQyA2NDgwLCBGZWJydWFyeSAyMDEyLg0KDQog ICBbMTNdICBLdW1hcmksIFcuIGFuZCBLLiBTcmlyYW0sICJSZWNvbW1lbmRhdGlvbiBmb3IgTm90 IFVzaW5nIEFTX1NFVA0KICAgICAgICAgYW5kIEFTX0NPTkZFRF9TRVQgaW4gQkdQIiwgUkZDIDY0 NzIsIERlY2VtYmVyIDIwMTEuDQoNCiAgIFsxNF0gIEtlbnQsIFMuIGFuZCBBLiBDaGksICJUaHJl YXQgTW9kZWwgZm9yIEJHUCBQYXRoIFNlY3VyaXR5IiwgUkZDDQogICAgICAgICA3MTMyLCBGZWJy dWFyeSAyMDE0Lg0KDQogDQoNCg0KTGVwaW5za2kgICAgICAgICAgICAgICAgICBFeHBpcmVzIE1h eSA2LCAyMDE2ICAgICAgICAgICAgICAgICAgW1BhZ2UgMzJdDQoMDQpJbnRlcm5ldC1EcmFmdCAg ICAgICAgICAgICAgQkdQc2VjIFByb3RvY29sICAgICAgICAgICAgIERlY2VtYmVyIDYsIDIwMTUN Cg0KDQogICBbMTVdICBCdXNoLCBSLiBhbmQgUi4gQXVzdGVpbiwgIlRoZSBSZXNvdXJjZSBQdWJs aWMgS2V5DQogICAgICAgICBJbmZyYXN0cnVjdHVyZSAoUlBLSSkgdG8gUm91dGVyIFByb3RvY29s IiwgUkZDIDY4MTAsIEphbnVhcnkNCiAgICAgICAgIDIwMTMuDQoNCiAgIFsxNl0gIEJ1c2gsIFIu LCBQYXRlbCwgSy4sIGFuZCBTLiBUdXJuZXIsICJSb3V0ZXIgS2V5IFBEVSBmb3IgUlBLSS0NCiAg ICAgICAgIFJvdXRlciBQcm90b2NvbCIsIGRyYWZ0LXltYmstcnBraS1ydHIta2V5cyAod29yayBp biBwcm9ncmVzcyksDQogICAgICAgICBBcHJpbCAyMDEzLg0KDQogICBbMTddICBCdXNoLCBSLiwg IkJHUHNlYyBPcGVyYXRpb25hbCBDb25zaWRlcmF0aW9ucyIsIGRyYWZ0LWlldGYtc2lkci0NCiAg ICAgICAgIGJncHNlYy1vcHMgKHdvcmsgaW4gcHJvZ3Jlc3MpLCBNYXkgMjAxMi4NCg0KICAgWzE4 XSAgR2VvcmdlLCBXLiBhbmQgUy4gTXVycGh5LCAiQkdQc2VjIENvbnNpZGVyYXRpb25zIGZvciBB Uw0KICAgICAgICAgTWlncmF0aW9uIiwgZHJhZnQtaWV0Zi1zaWRyLWFzLW1pZ3JhdGlvbiAod29y ayBpbiBwcm9ncmVzcyksDQogICAgICAgICBKdWx5IDIwMTQuDQoNCiAgIFsxOV0gSHVzdG9uLCBH LiBhbmQgRy4gTWljaGFlbHNvbiwgIlZhbGlkYXRpb24gb2YgUm91dGUgT3JpZ2luYXRpb24NCiAg ICAgICAgIFVzaW5nIHRoZSBSZXNvdXJjZSBDZXJ0aWZpY2F0ZSBQdWJsaWMgS2V5IEluZnJhc3Ry dWN0dXJlIChQS0kpDQogICAgICAgICBhbmQgUm91dGUgT3JpZ2luIEF1dGhvcml6YXRpb25zIChS T0FzKSIsIFJGQyA2NDgzLCBGZWJydWFyeQ0KICAgICAgICAgMjAxMy4NCg0KICAgWzIwXSBNb2hh cGF0cmEsIFAuLCBTY3VkZGVyLCBKLiwgV2FyZCwgRC4sIEJ1c2gsIFIuLCBhbmQgUi4gQXVzdGVp biwNCiAgICAgICAgICJCR1AgUHJlZml4IE9yaWdpbiBWYWxpZGF0aW9uIiwgUkZDIDY4MTEsIEph bnVhcnkgMjAxMy4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQogDQoNCg0KTGVwaW5za2kgICAgICAgICAgICAgICAgICBFeHBpcmVzIE1heSA2LCAy MDE2ICAgICAgICAgICAgICAgICAgW1BhZ2UgMzNdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICAgICAg ICAgICAgQkdQc2VjIFByb3RvY29sICAgICAgICAgICAgIERlY2VtYmVyIDYsIDIwMTUNCg0KDQpB dXRob3IncyBBZGRyZXNzDQoNCiAgIE1hdHRoZXcgTGVwaW5za2kgKGVkaXRvcikNCiAgIE5ldyBD b2xsZWdlIG9mIEZsb3JpZGENCiAgIDU4MDAgQmF5IFNob3JlIFJvYWQNCiAgIFNhcmFzb3RhLCBG TCAzNDI0Mw0KICAgVVMNCg0KICAgUGhvbmU6ICsxIDk0MSA0ODcgNTAwMA0KICAgRW1haWw6IG1s ZXBpbnNraUBuY2YuZWR1DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KTGVwaW5za2kgICAgICAg ICAgICAgICAgICBFeHBpcmVzIE1heSA2LCAyMDE2ICAgICAgICAgICAgICAgICAgW1BhZ2UgMzRd DQo= --001a113f8ffad8b0b1052647afcd-- From nobody Mon Dec 7 09:43:25 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 88E021AD0B8 for ; Mon, 7 Dec 2015 09:43:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.899 X-Spam-Level: X-Spam-Status: No, score=-101.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nL3LWHl9j2ra for ; Mon, 7 Dec 2015 09:43:22 -0800 (PST) Received: from odin.smetech.net (x-bolt-wan.smeinc.net [209.135.219.146]) by ietfa.amsl.com (Postfix) with ESMTP id 5685D1AD0B0 for ; Mon, 7 Dec 2015 09:43:22 -0800 (PST) Received: from localhost (unknown [209.135.209.5]) by odin.smetech.net (Postfix) with ESMTP id AE91CF24062; Mon, 7 Dec 2015 12:43:11 -0500 (EST) X-Virus-Scanned: amavisd-new at smetech.net Received: from odin.smetech.net ([209.135.209.4]) by localhost (ronin.smeinc.net [209.135.209.5]) (amavisd-new, port 10024) with ESMTP id 8WIFK+GV+Z3L; Mon, 7 Dec 2015 12:41:42 -0500 (EST) Received: from [192.168.2.104] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by odin.smetech.net (Postfix) with ESMTP id C3D43F24041; Mon, 7 Dec 2015 12:42:50 -0500 (EST) Mime-Version: 1.0 (Apple Message framework v1085) Content-Type: multipart/alternative; boundary=Apple-Mail-119-904040590 From: Russ Housley In-Reply-To: Date: Mon, 7 Dec 2015 12:42:39 -0500 Message-Id: <6044AD11-CC42-4680-B627-876C004DBCDC@vigilsec.com> References: To: Matthew Lepinski X-Mailer: Apple Mail (2.1085) Archived-At: Cc: "sidr@ietf.org" Subject: Re: [sidr] BGPsec - Security Guarantees : Modified Text X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2015 17:43:24 -0000 --Apple-Mail-119-904040590 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Matt: I would prefer that the updated I-D get posted. That way, the document = we are discussing is in the archive. It also makes it easy to use the = datatracker diff tools. The new Section 4.1 says: Conversely, if a BGPsec router has received a BGPsec update message (with the BGPsec_Path attribute) from a peer for a given prefix and it chooses to propagate that peer's route for the prefix, then it SHOULD propagate the route as a BGPsec update message containing the BGPsec_Path attribute. I agree with the point that is being made here, but there is an = assumption that it possess a private signature key for the right = algorithm suite. This point is made in another paragraph, but that = paragraph does not contain a SHOULD. Therefore, I think this paragraph = needs to say that it SHOULD propagate a signed BGPsec_Path attribute if = it have the needed private key and certificate. Typo: s/Signature_ Blocks/Signature_Blocks/ Russ On Dec 6, 2015, at 11:56 PM, Matthew Lepinski wrote: > There was a discussion back in October in which the working group = supported significant changes to BGPsec-protocol. This was to address an = identified mis-match between what was stated (for security properties) = and what was actually achieved. >=20 > To address these concerns, I have made substantial changes to Section = 4 (propagating update messages) and smaller changes to Section 5.2 = (validation algorithm). >=20 > The security considerations text likely still needs to be modified, = but it would be helpful if someone in the group took a look at the new = Section 4 and provided feedback on whether the new text is in line with = the conclusions from this thread: = http://www.ietf.org/mail-archive/web/sidr/current/msg07291.html >=20 > Thanks a lot, > - Matt Lepinski --Apple-Mail-119-904040590 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
There was a discussion back in October in = which the working group supported significant changes to = BGPsec-protocol. This was to address an identified mis-match between = what was stated (for security properties) and what was actually = achieved.

To address these concerns, I have made substantial = changes to Section 4 (propagating update messages) and smaller changes = to Section 5.2 (validation algorithm).

The security = considerations text likely still needs to be modified, but it would be = helpful if someone in the group took a look at the new Section 4 and = provided feedback on whether the new text is in line with the = conclusions from this thread: h= ttp://www.ietf.org/mail-archive/web/sidr/current/msg07291.html

Thanks a lot,
- Matt Lepinski

= --Apple-Mail-119-904040590-- From nobody Mon Dec 7 11:11:28 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F33021B39ED for ; Mon, 7 Dec 2015 11:11:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UR0sHukJtwN6 for ; Mon, 7 Dec 2015 11:11:25 -0800 (PST) Received: from walnut.tislabs.com (walnut.tislabs.com [192.94.214.200]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD52B1B39E4 for ; Mon, 7 Dec 2015 11:11:25 -0800 (PST) Received: from nova.tislabs.com (unknown [10.66.1.77]) by walnut.tislabs.com (Postfix) with ESMTP id 159DB28B0041 for ; Mon, 7 Dec 2015 14:11:25 -0500 (EST) Received: from [IPv6:::1] (localhost.localdomain [127.0.0.1]) by nova.tislabs.com (Postfix) with ESMTP id F08931F801E; Mon, 7 Dec 2015 14:11:24 -0500 (EST) From: Sandra Murphy X-Pgp-Agent: GPGMail 2.5.1 Content-Type: multipart/signed; boundary="Apple-Mail=_E6D7FC6B-E612-4298-8BE7-05FB8C3795AD"; protocol="application/pgp-signature"; micalg=pgp-sha512 Date: Mon, 7 Dec 2015 14:11:23 -0500 Message-Id: To: sidr Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: Sandra Murphy Subject: [sidr] IETF 94 minutes uploaded X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2015 19:11:27 -0000 --Apple-Mail=_E6D7FC6B-E612-4298-8BE7-05FB8C3795AD Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 The minutes as taken from the etherpad have been uploaded. See = https://www.ietf.org/proceedings/94/minutes/minutes-94-sidr. Many thanks to our minutes takers and jabber scribes. Special = recognition to Sue Hares, the minutes taker for Tuesday, who was ill for = several weeks after the meeting. =97Sandy --Apple-Mail=_E6D7FC6B-E612-4298-8BE7-05FB8C3795AD Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWZdnbAAoJEHplpQeet0IZt7cP/2PG/zMoxMz1w5mGXN2soYja hNC6Nt+pkypEC9HuAbG+5P1w86d9AChlkk2Pb4NaWXJGpe3Ta1Japxv2cDxUmkFz H81+t1aN/C63xHNJVaUx/7gEgOoZkLh3u22BwglegpGJ2x2Rswy99X9zEgT0jZ90 LN5e6zfkvWmAFLi4k4lW7azNd30x2/GhqkfdNQ+j35MVfNOZeR974+Q1YpA0QM6J OFrPDe0XhFNaAtKyO2qXqcOfgoSNj/vNN5A0TxeHXOLgUy+kPG6i07ziEyr50XsG jnIbNWWdS68fKvmUUB5ivGPJvKGKYS/JeiJcJYRil8K03K5KHY91YQ3gYjb4caKA z0fNCzivjdZqx6zMZrYk0CppN5SbqiVs3r22bRslHvh8k0yiLZgN+MuGKyoBVfqQ +JPH+q7QSVW6odxAYMhWb/aUm9s5zByNDSHp/XHb8feqVe/AaCxtQNk0zaakgKrh kuqa4oCR1i+Mo+9kFCd/uYi89MzOYmQ4vh1DzyXJOeQZCprDZcgR09xeqcFr3kUJ CuVVwSJE8/aH/Z8lZWlab0THFMVAXJwZMbj4X8PBEhN8XsscM2bMAm3SHm9tkt1I CAMXBQtF4R784B+EZCF5k1paTtOQHxGG/U1BYNPKJruXbE/7cpReJGICyXM9YZMt 4Ow+nnl9rEH0lmeG3cun =ZwZU -----END PGP SIGNATURE----- --Apple-Mail=_E6D7FC6B-E612-4298-8BE7-05FB8C3795AD-- From nobody Mon Dec 7 15:55:32 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D13871A88B9 for ; Mon, 7 Dec 2015 15:55:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.312 X-Spam-Level: X-Spam-Status: No, score=-2.312 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id viA_OFfUpUnw for ; Mon, 7 Dec 2015 15:55:28 -0800 (PST) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D27641A88A6 for ; Mon, 7 Dec 2015 15:55:28 -0800 (PST) Received: from dhcp89-089-173.bbn.com ([128.89.89.173]:54020) by smtp.bbn.com with esmtps (TLSv1:AES128-SHA:128) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1a65cq-000Hcu-3n; Mon, 07 Dec 2015 18:55:24 -0500 To: Geoff Huston References: <565617E8.4070005@bbn.com> From: Karen Seo Message-ID: <56661C6B.2060006@bbn.com> Date: Mon, 7 Dec 2015 18:55:23 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Thunderbird/38.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: sidr Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Dec 2015 23:55:31 -0000 Just fyi... Steve was out of the country last week and this. He should be back next week... On 11/25/15 8:11 PM, Geoff Huston wrote: > Hi, > > I’m working through this example and I can’t help but observe that its > "ill-defined and, the most likely interpretation doesn't seem to work” > to borrow your words…. > >> Consider a cert path from a trust anchor TA, to CA1 to CA2 to an EE cert for a ROA. >> >> TA->CA 1->CA 2->ROA >> >> >> Assume the TA cert contains address space T, U, V, W, X, Y and Z. >> >> Assume the CA 1 cert contains address space T, U, V, and W. >> >> Assume the CA 2 cert contains address space V and W. >> >> Let's say that the ROA EE cert issued by CA 2 contains address space V. >> >> CA 2 is about to receive address space Z from some other ISP, so it has asked >> CA 1 to issue a new CA cert to it, in anticipation of the transfer. CA 1 agrees, >> and issues a new cert to CA 2 and that cert contains address space V and Z. > CA1 has already issued a cert with subject “CA2” and resources (V,W) - lets call this cert No 1 > > Do you mean: > > a) CA 1 issues a cert with subject “CA2” and resources (V,Z) - lets call this cert No 2 > > OR the combination of actions: > > b) CA 1 issues a SECOND cert with subject “CA2” and resources (V,Z) - lets call this Cert No 2 > AND > CA1 revokes the cert with subject “CA2” and resources (V,W) (which we call Cert No 1) > > >> Now, under the assumption about what "specific resource set" means, when >> an RP tries to validate CA 2's ROA, > Now I’m confused - originally the ROA was signed by an EE cert issued by CA 2’s Cert No 1 > > so when you refer to CA 2’s ROA do you mean the ROA that was signed by an EE cert issued by CA 2’s Cert No 1, > or do you mean a new ROA signed by an EE issued by CA 2’s Cert No 2? > > >> the "specific resource set" will be V, and >> so it will be valid, because V is in all of the certs from the TA through CA 1 >> to CA 2. Even though CA 2's cert contains Z, which is not contained >> in CA 1's cert, this will not be considered in the validation of the ROA EE cert. >> This is the desired outcome, because CA 2 has begun the process of getting its >> new address space (Z), but that process has not broken its CA cert. I assume this >> is an example of the reduced fragility that is so appealing. > > So I _think_ you are assuming that there is a new ROA, signed by an EE cert issued by > the CA that has a CA cert issued by CA 1 with resources (V,Z), and evidently you are referring > to this new ROA and its new EE cert. > > >> If CA 2 issued a ROA for Z, then validation of that ROA would fail, because >> the CA 1 cert does not contain Z. That's good, because the second ROA exmaple >> ought not be valid, since the transfer has not yet completed. >> >> So far, so good. But, let's look at the implications of this revised validation >> procedure in greater depth. >> >> What if CA 1, acting on the request from CA 2 asked the TA to add Z to CA 2's cert, > Huh????? > > The TA has issued a cert for subject “CA 1” - Since when did Ca2 have a relationship > with the TA? > >> >> in anticipation of the transfer? Then we have a problem, because Z is under the >> tree from this TA and if it agreed to add Z to CA 1's cert, then a ROA for Z, >> issued by CA 2, would be valid, even though the transfer had not yet been effected. > I’m having trouble following this - I think you have a typo of otherwise confused > the example at this point. > > I’ll stop here because I can’t see the point of the ensuring text without some additional > clarity and precision of the example scenario that does not invent arbitrary relationships > between CAs. > > regards, > > Geoff > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From nobody Tue Dec 8 12:41:18 2015 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 094E31A6FA7; Tue, 8 Dec 2015 12:41:16 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.11.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20151208204116.30503.33351.idtracker@ietfa.amsl.com> Date: Tue, 08 Dec 2015 12:41:16 -0800 Archived-At: Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-bgpsec-protocol-14.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Dec 2015 20:41:16 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. Title : BGPsec Protocol Specification Author : Matthew Lepinski Filename : draft-ietf-sidr-bgpsec-protocol-14.txt Pages : 34 Date : 2015-12-08 Abstract: This document describes BGPsec, an extension to the Border Gateway Protocol (BGP) that provides security for the path of autonomous systems through which a BGP update message passes. BGPsec is implemented via a new optional non-transitive BGP path attribute that carries a digital signature produced by each autonomous system that propagates the update message. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-protocol/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-sidr-bgpsec-protocol-14 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-bgpsec-protocol-14 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Dec 9 08:21:46 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B9841A89E1 for ; Wed, 9 Dec 2015 08:21:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QF7IKwfaUD9b for ; Wed, 9 Dec 2015 08:21:44 -0800 (PST) Received: from walnut.tislabs.com (walnut.tislabs.com [192.94.214.200]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E26FF1A6F83 for ; Wed, 9 Dec 2015 08:21:43 -0800 (PST) Received: from nova.tislabs.com (unknown [10.66.1.77]) by walnut.tislabs.com (Postfix) with ESMTP id 0BCE028B0041 for ; Wed, 9 Dec 2015 11:21:43 -0500 (EST) Received: from [IPv6:::1] (localhost.localdomain [127.0.0.1]) by nova.tislabs.com (Postfix) with ESMTP id D09291F801E; Wed, 9 Dec 2015 11:21:42 -0500 (EST) Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Content-Type: multipart/signed; boundary="Apple-Mail=_6453FFA9-E87A-4144-A77E-A220DD2DA22D"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail 2.5.1 From: Sandra Murphy In-Reply-To: Date: Wed, 9 Dec 2015 11:20:52 -0500 Message-Id: <130DE130-2FEB-4B76-BC29-607495E7371B@tislabs.com> References: To: Sandra Murphy X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: sidr Subject: [sidr] Please review and send updates: IETF 94 minutes X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 16:21:45 -0000 --Apple-Mail=_6453FFA9-E87A-4144-A77E-A220DD2DA22D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 The final deadline for minutes is 12/21. Please review and provide = updates to the list before 12/18. =97Sandy On Dec 7, 2015, at 2:11 PM, Sandra Murphy wrote: > The minutes as taken from the etherpad have been uploaded. See = https://www.ietf.org/proceedings/94/minutes/minutes-94-sidr. >=20 > Many thanks to our minutes takers and jabber scribes. Special = recognition to Sue Hares, the minutes taker for Tuesday, who was ill for = several weeks after the meeting. >=20 > =97Sandy >=20 --Apple-Mail=_6453FFA9-E87A-4144-A77E-A220DD2DA22D Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWaFT0AAoJEHplpQeet0IZpJIP/irnuP2+eQ2z9CFP2tDfpY7J u619sj/12DQNh9pCKQ4kjyAbOGjSgkjndWeUEjlEzSht7v1KhJ4UqFrOrS8TnG8M X+dfh/vX0EjMUySibPGag6xOld4ErOStoORSFWPUcWRy/5H6WRDuPy9OY+RkSRqm 4ihbWXwKXnC7Case9zfj+RDbm6bICYj0/UKP6BZQugug1sAQL3YXo8Y1RK8TA2+S bDeA4+uQErTFJqBcXnUYXuo+vYljDIl5GXjeKlqzoZEl7lpbaK0irbnXCqTu+ZaV QumWZan//K5wGCO8pMLC4xKojF69YZ0+CdMqfo9bUxckyQJ0FmPEF83Sp3PJ5k/x dLI03L8nrIIvebQTXowhUYUZy8jlx116ryJwOK10rTSoEv0c27nf5LloFdF1kpxf tMuB1i2pPq+4cvF9Lw6PolZwygwhgJ2Ct7pMCV0ZzntXdKluM3EZq9Jenz0OO00H 4EG9a1/xC+7ghVEeL0euds+UncnlIHFm3P72SaFYeJXGT2Cemmznt/SNpD7MZoY9 1Ki5uprLSBm2hC2k3QwlsTkjEwYpFqYWahV40QcxuByybjhVAcFA24x6/csB44Aw jY1hbSG6MYoZeeJ1/N7/76as0RopU3O03nrT/ONgXVdtU4syR0G50hwFSMg7/nkf ua20kFBFvBq1cdb540ZF =Kj/Z -----END PGP SIGNATURE----- --Apple-Mail=_6453FFA9-E87A-4144-A77E-A220DD2DA22D-- From nobody Wed Dec 9 15:08:34 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CCC911B2F92 for ; Wed, 9 Dec 2015 15:08:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XF_Fat7hhJR1 for ; Wed, 9 Dec 2015 15:08:32 -0800 (PST) Received: from walnut.tislabs.com (walnut.tislabs.com [192.94.214.200]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77ED51B2F9B for ; Wed, 9 Dec 2015 15:08:32 -0800 (PST) Received: from nova.tislabs.com (unknown [10.66.1.77]) by walnut.tislabs.com (Postfix) with ESMTP id 9A29C28B0041 for ; Wed, 9 Dec 2015 18:08:31 -0500 (EST) Received: from [IPv6:::1] (localhost.localdomain [127.0.0.1]) by nova.tislabs.com (Postfix) with ESMTP id 6EE921F801E; Wed, 9 Dec 2015 18:08:31 -0500 (EST) From: Sandra Murphy X-Pgp-Agent: GPGMail 2.5.1 Content-Type: multipart/signed; boundary="Apple-Mail=_C4047F23-3094-4AC1-8CBF-36C1BCD85B87"; protocol="application/pgp-signature"; micalg=pgp-sha512 Date: Wed, 9 Dec 2015 18:08:14 -0500 Message-Id: To: sidr Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: Sandra Murphy Subject: [sidr] wg adoption call for draft-tbruijnzeels-sidr-validation-local-cache-02 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 23:08:34 -0000 --Apple-Mail=_C4047F23-3094-4AC1-8CBF-36C1BCD85B87 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii As noted in the minutes, the authors of = draft-tbruijnzeels-sidr-validation-local-cache-02 request that the = working group adopt this work as a wg work item. A working group adoption poll starts now and will end 14 days from now = on 23 December. Please respond on the list to say whether you support adoption of this = work as a working group work item AND whether you will participate in = the discussion. Remember that working group consensus to adopt the work needs responses, = not just absence of objection, so speak up. --Sandy, speaking as one of the wg co-chairs --Apple-Mail=_C4047F23-3094-4AC1-8CBF-36C1BCD85B87 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWaLRtAAoJEHplpQeet0IZ3+UQAMhSaBUOEBWtN/SeIHKYXsEk XOj3cZgU8WwV92Hfyjy0RZANlj2YVdXwmGGbv9O799Tqc7MnTZNZf5bAf5vPwGQP qM8jwbg+B/Rx9tKv2I8icQDT/v1e6Tn1jyXC6kk39rjfN0dvfj+peSKuIM0cEcri G+QUkqT+ZBVnT9tySTt+CsCzLx9KASSpARnI4R/X9GwE5T/sXXq3hDuHse826xRZ M4vhlpioWlzD6wwlOpSvB3dHoGas4uFf6jPxZDNqUYshKAW2BOpcBkLeMHXm0s2V 1T6AnuQLEdKeVPwDTnGINmPAMF6ZpZNcIJSoME8cDpUY6EYwRfH3HnjvPuixfKSh ijDZ6ql8Tqm5aGdjeOPPJ4htZaKQxKjRTf5Yq89xngARvhZdAixZg42ZLGUxaPg0 trS/H2RklylMmy+i/vrj0UV1z1KYuN/qou8iwqXZQpbM7ws+h+oMep3mbsvvQ8LG ZJwI35WKkyazNEoOwsPdtz4Th7l7CDkdvggCGVL3kZ3e9Zf1UfuQ0MT1wyr5jgko FO5Y8hXfMmgzcwIoeifuo6GvMgYN/Ds4KrnS5NpH7vxKdqpnFc8sAkBfb+Mjt6CL 0a5+dESPUS6R9GiD1XO+b66DByAUxBSltA56RuAIl7ageQOa61wadeezj1DTJxyJ P3kocCUR+Cypsz+2t2c+ =up0h -----END PGP SIGNATURE----- --Apple-Mail=_C4047F23-3094-4AC1-8CBF-36C1BCD85B87-- From nobody Wed Dec 9 15:21:37 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B1EA21B2FBD for ; Wed, 9 Dec 2015 15:21:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fl0DGWUNuF3M for ; Wed, 9 Dec 2015 15:21:35 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 04B921B2FDE for ; Wed, 9 Dec 2015 15:21:34 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.82) (envelope-from ) id 1a6o3A-0004kL-Lq; Wed, 09 Dec 2015 23:21:32 +0000 Date: Thu, 10 Dec 2015 08:21:31 +0900 Message-ID: From: Randy Bush To: Sandra Murphy In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Cc: sidr Subject: Re: [sidr] wg adoption call for draft-tbruijnzeels-sidr-validation-local-cache-02 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Dec 2015 23:21:35 -0000 have read. support adoption randy From nobody Fri Dec 11 07:26:31 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 504F21B2AA9 for ; Fri, 11 Dec 2015 07:26:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mU9GUlVNhmAk for ; Fri, 11 Dec 2015 07:26:28 -0800 (PST) Received: from mail-qk0-x234.google.com (mail-qk0-x234.google.com [IPv6:2607:f8b0:400d:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 28A7B1B2AB5 for ; Fri, 11 Dec 2015 07:26:26 -0800 (PST) Received: by qkdp187 with SMTP id p187so43018024qkd.1 for ; Fri, 11 Dec 2015 07:26:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type:content-transfer-encoding; bh=rPtXqfxy7KzDS1ka+DQW70pcoW2RltWdj3xKhL+JUGk=; b=Oys5Owhr19nk+TOQgyIByI2BdgFnX/jK2iLQ0KXU5LRZp3iu/xK/ic6vvbtJBCKdu/ +s0nN3XiJW7lM/KIK7iZNegd30uOaAXqdawcKXA4kK33SWF/QOMMydjZezoIbes1JP56 tiSxG33xgeLUy92sf5BYVoRo8d2UjOU2IK3Od+6ABlv81p7G9H+FjK61g2f2DraiScm4 gy2Jj0qKJUL6sbifH3txkDhJucXTZRjeTil3/mpUpnZn/VSDLsclkrXWoEmkFmrMOKuK zgILIzYOEcRGazJtq2SiYXBD5t2L1QCo/Uj48UvfhuyrWySeERTKg10c37kicOcO0OR7 /xIA== MIME-Version: 1.0 X-Received: by 10.129.97.11 with SMTP id v11mr9038867ywb.113.1449847585307; Fri, 11 Dec 2015 07:26:25 -0800 (PST) Sender: christopher.morrow@gmail.com Received: by 10.129.99.9 with HTTP; Fri, 11 Dec 2015 07:26:25 -0800 (PST) In-Reply-To: References: <20151016155343.16008.68230.idtracker@ietfa.amsl.com> Date: Fri, 11 Dec 2015 10:26:25 -0500 X-Google-Sender-Auth: _PG6IlhMNQqVT3ZvP4AiMQDTw0c Message-ID: From: Christopher Morrow To: "George, Wes" Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: Cc: "sidr@ietf.org" Subject: Re: [sidr] I-D Action: draft-ietf-sidr-as-migration-04.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2015 15:26:30 -0000 howdy! On Tue, Dec 1, 2015 at 11:38 AM, Christopher Morrow wrote: > On Tue, Dec 1, 2015 at 11:29 AM, Christopher Morrow > wrote: >> Unless the commentors speak up in the next 2-3 days I'll kick this >> forward to the IESG for publication... > > For those that like precise dates: > dec 3 2015 2200 UTC (or there abouts) > 12/3/2015 passed... I'll be shipping this northward today/monday. thanks for the consideration and thought on the draft. -chris >> >> On Fri, Oct 16, 2015 at 12:01 PM, George, Wes wrote: >>> I believe that this draft is complete and ready to move forward. This >>> version addresses AD-review comments received at WGLC, so I think we're >>> just waiting for it to be resubmitted to IESG for IETF LC, as the chang= es >>> made were likely not substantive enough to require a new WGLC. I do *no= t* >>> need time to discuss this during the meeting either. >>> >>> Thanks, >>> >>> Wes >>> >>> >>> >>> >>> On 10/16/15, 11:53 AM, "sidr on behalf of internet-drafts@ietf.org" >>> wrote: >>> >>>> >>>>A New Internet-Draft is available from the on-line Internet-Drafts >>>>directories. >>>> This draft is a work item of the Secure Inter-Domain Routing Working >>>>Group of the IETF. >>>> >>>> Title : BGPSec Considerations for AS Migration >>>> Authors : Wesley George >>>> Sandy Murphy >>>>Filename : draft-ietf-sidr-as-migration-04.txt >>>>Pages : 15 >>>>Date : 2015-10-16 >>>> >>>>Abstract: >>>> This document discusses considerations and methods for supporting an= d >>>> securing a common method for AS-Migration within the BGPSec protocol= . >>>> >>>> >>>>The IETF datatracker status page for this draft is: >>>>https://datatracker.ietf.org/doc/draft-ietf-sidr-as-migration/ >>>> >>>>There's also a htmlized version available at: >>>>https://tools.ietf.org/html/draft-ietf-sidr-as-migration-04 >>>> >>>>A diff from the previous version is available at: >>>>https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-as-migration-04 >>>> >>>> >>>>Please note that it may take a couple of minutes from the time of >>>>submission >>>>until the htmlized version and diff are available at tools.ietf.org. >>>> >>>>Internet-Drafts are also available by anonymous FTP at: >>>>ftp://ftp.ietf.org/internet-drafts/ >>>> >>>>_______________________________________________ >>>>sidr mailing list >>>>sidr@ietf.org >>>>https://www.ietf.org/mailman/listinfo/sidr >>> >>> >>> ________________________________ >>> >>> This E-mail and any of its attachments may contain Time Warner Cable pr= oprietary information, which is privileged, confidential, or subject to cop= yright belonging to Time Warner Cable. This E-mail is intended solely for t= he use of the individual or entity to which it is addressed. If you are not= the intended recipient of this E-mail, you are hereby notified that any di= ssemination, distribution, copying, or action taken in relation to the cont= ents of and attachments to this E-mail is strictly prohibited and may be un= lawful. If you have received this E-mail in error, please notify the sender= immediately and permanently delete the original and any copy of this E-mai= l and any printout. >>> _______________________________________________ >>> sidr mailing list >>> sidr@ietf.org >>> https://www.ietf.org/mailman/listinfo/sidr From nobody Fri Dec 11 09:42:13 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3EFC41A904F; Fri, 11 Dec 2015 09:42:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pgYbUjK-orgj; Fri, 11 Dec 2015 09:42:09 -0800 (PST) Received: from walnut.tislabs.com (walnut.tislabs.com [192.94.214.200]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7BD2A1B2DA9; Fri, 11 Dec 2015 09:42:09 -0800 (PST) Received: from nova.tislabs.com (unknown [10.66.1.77]) by walnut.tislabs.com (Postfix) with ESMTP id CA57928B003D; Fri, 11 Dec 2015 12:42:08 -0500 (EST) Received: from [IPv6:::1] (localhost.localdomain [127.0.0.1]) by nova.tislabs.com (Postfix) with ESMTP id 90C9A1F8051; Fri, 11 Dec 2015 12:42:08 -0500 (EST) Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Content-Type: multipart/signed; boundary="Apple-Mail=_9C2C0F1F-A5E4-413E-8E2F-7036C0D55EA9"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail 2.5.1 From: Sandra Murphy In-Reply-To: <34A163BE-44D1-4994-AEFA-9F09CD0C28AE@tislabs.com> Date: Fri, 11 Dec 2015 12:41:42 -0500 Message-Id: References: <20151118020907.790.34242.idtracker@ietfa.amsl.com> <938892D5-919F-4C61-B518-7145CB40A05B@tislabs.com> <34A163BE-44D1-4994-AEFA-9F09CD0C28AE@tislabs.com> To: sidr X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: "draft-ietf-sidr-rfc6485bis@ietf.org" , "sidr-chairs@ietf.org" , Sandra Murphy Subject: Re: [sidr] Terry Manderson's Discuss on draft-ietf-sidr-rfc6485bis-04: (with DISCUSS) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2015 17:42:11 -0000 --Apple-Mail=_9C2C0F1F-A5E4-413E-8E2F-7036C0D55EA9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 On Dec 5, 2015, at 12:29 AM, Sandra Murphy wrote: > The AD, the chairs and the authors have discussed the draft change = suggested below. >=20 > To summarize: The language Terry=92s DISCUSS objects to is SHOULD = recommendations of how to handle algorithm transitions, and being SHOULD = only, leads to potential differences in implementation and operation = choice. RFC6916 made much more stringent descriptions of algorithm = transition and mandates certain actions. RFC6916 was published a year = after RFC6485 and rfc6485bis attempts to meld the two by pointing to it, = but leaves the SHOULD language in place. >=20 > The decision of AD, chairs and authors is that the wg consensus for = rfc6485bis was focussed on the OID problem, so it could not be said that = this section was carefully considered by the wg. >=20 > So the draft draft-ietf-sidr-rfc6485bis-04 is being returned to the wg = to address this problem and then to do a wglc (and IETF Last Call) = before it is returned to the IESG. >=20 >=20 > =97Sandy, speaking as one of the co-chairs speaking as document shepherd. This message is intended to spark discussion. Terry agreed that his preference is to remove the SHOULD language. He = did not insist that this was the only way to go. >>>=20 >>>=20 >>>=20 >>> Would you prefer that RFC6485bis remove the inherited =B3SHOULD=B2 = language >>> and point only to RFC6916? >>=20 >> Yes, That is certainly one way to address this. And I would be OK = with >> that. >>=20 >=20 If we did do that, it could look like: OLD It is anticipated that the RPKI will require the adoption of updated key sizes and a different set of signature and hash algorithms over time, in order to maintain an acceptable level of cryptographic security to protect the integrity of signed products in the RPKI. This profile should be replaced to specify such future requirements, as and when appropriate. Certification Authorities (CAs) and RPs SHOULD be capable of supporting a transition to allow for the phased introduction of additional encryption algorithms and key specifications, and also accommodate the orderly deprecation of previously specified algorithms and keys. Accordingly, CAs and RPs SHOULD be capable of supporting multiple RPKI algorithm and key profiles simultaneously within the scope of such anticipated transitions. The recommended procedures to implement such a transition of key sizes and algorithms is specified in [RFC6916] NEW It is anticipated that the RPKI will require the adoption of updated key sizes and a different set of signature and hash algorithms over time, in order to maintain an acceptable level of cryptographic security to protect the integrity of signed products in the RPKI. This profile should be replaced to specify such future requirements, as and when appropriate. The mandated procedures to implement a transition of key sizes and algorithms are specified in [RFC6916]. Comments? =97Sandy, speaking as document shepherd and regular ol=92 member --Apple-Mail=_9C2C0F1F-A5E4-413E-8E2F-7036C0D55EA9 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWawruAAoJEHplpQeet0IZK60P/0TAc/AAhoA96shzAv3m8RXb jvAP+To83MjxW1FaEYRnJgcdDYooqJ1MW7Hyj2a5DwdrxXS4zgjBjnO8NgQo568W LZE9pOrEmkVaSatfg3lojVmypXif3tRnFL3c/jFJpNwyHDl386ZfCtketrrk8yc+ +enC7rIZgH5VSRT77ltAJg1u9KSsERFmr4iC2iPzyptI+fARXL+eY3gewjtmy7QM XNqGaElEyZAi8asFNywnnPzFzC6fsMMXcU62F2kvBlFsM1HgGMPvNlff5m2irLpM yWc8w4KRqT1pko2l0NOSEv91SUv6iYy4jNsDXscOCJHIGVvVueTkBJhwFv9N63KM +XtonmaBxonsEQ5CVWVMpfSYEJGkYTjuIOgYvCjOsWS/rhFKcnaiR7mIQxC0uCHz seyCbHGdzMTegL53qLw4kmk1y9vuQZ/2gYhLlMuap4lvQInPLvWSYYaZI26/pC70 xDo1vD2UmWVkdMv5Nf7CC7eN7sztqmke6v6JP0Oq6tE7bhcs6b4H1ERQm/GS2IkB Xa31ST63ueVxkgYy3KYKF5gu7bFYodExAht4BXXigU95lGcNHCpcAbBm2hTOKcPj /kSv2ri+zd6OT13ftfIH2slTYR3be75m1QtNK+wWnVumyuV+Iy8DdCaElR85mIK0 s4fmC3Qwa+XxA94iwmPA =W+jx -----END PGP SIGNATURE----- --Apple-Mail=_9C2C0F1F-A5E4-413E-8E2F-7036C0D55EA9-- From nobody Fri Dec 11 09:46:16 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 343FA1A8F3F; Fri, 11 Dec 2015 09:46:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A61Mx4NZSKLd; Fri, 11 Dec 2015 09:46:13 -0800 (PST) Received: from walnut.tislabs.com (walnut.tislabs.com [192.94.214.200]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B93081B2DC0; Fri, 11 Dec 2015 09:46:11 -0800 (PST) Received: from nova.tislabs.com (unknown [10.66.1.77]) by walnut.tislabs.com (Postfix) with ESMTP id 0FE4D28B0041; Fri, 11 Dec 2015 12:46:11 -0500 (EST) Received: from [IPv6:::1] (localhost.localdomain [127.0.0.1]) by nova.tislabs.com (Postfix) with ESMTP id E7D0B1F801E; Fri, 11 Dec 2015 12:46:10 -0500 (EST) Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Content-Type: multipart/signed; boundary="Apple-Mail=_142B8DF5-710D-400F-B8EF-596FAC59DBD8"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail 2.5.1 From: Sandra Murphy In-Reply-To: <34A163BE-44D1-4994-AEFA-9F09CD0C28AE@tislabs.com> Date: Fri, 11 Dec 2015 12:46:08 -0500 Message-Id: <62398BC1-C603-4A1B-9C18-8FC252DB7D74@tislabs.com> References: <20151118020907.790.34242.idtracker@ietfa.amsl.com> <938892D5-919F-4C61-B518-7145CB40A05B@tislabs.com> <34A163BE-44D1-4994-AEFA-9F09CD0C28AE@tislabs.com> To: sidr X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: "draft-ietf-sidr-rfc6485bis@ietf.org" , "sidr-chairs@ietf.org" , Sandra Murphy Subject: Re: [sidr] Terry Manderson's Discuss on draft-ietf-sidr-rfc6485bis-04: (with DISCUSS) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2015 17:46:15 -0000 --Apple-Mail=_142B8DF5-710D-400F-B8EF-596FAC59DBD8 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 speaking as wg co-chair: On Dec 5, 2015, at 12:29 AM, Sandra Murphy wrote: >=20 > So the draft draft-ietf-sidr-rfc6485bis-04 is being returned to the wg = to address this problem and then to do a wglc (and IETF Last Call) = before it is returned to the IESG. >=20 >=20 Previous discussions on draft-ietf-sidr-rfc6485bis were restricted to = the OID problem. The current discussion and eventual wglc are not = restricted to the OID problem or to Terry=92s Discuss. =97Sandy, speaking as wg co-chair --Apple-Mail=_142B8DF5-710D-400F-B8EF-596FAC59DBD8 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWawvgAAoJEHplpQeet0IZB24P/3zcQsdF7i6qC/IkDAG2/Q5+ l4FP8NhNde2S43Mr6xMMM0xytXK/eg/ly+JDx+7umpjNmVmEXl7kW/nFdlnVPgG6 72eaYBsR9nG+7qpn3O0Gsz0SZTXOi5rr7HgpTQ10hn4f8vgTnk9FgvnlNNcOV6DO MzaS8fgi5OOBqIzRRWMjQAOMWRmZrwmnqysy4xRFTNlBUhgpB1peDv7hOAR7AYUX 3Tm/ERYvd/TvNwlIrD5K/fri6syWtbQx3LDpmLtCg91SIxMyDz/SoHIVtrURvWL3 +rHdzR2nsKljnpR7ND780d4OgBcGebomBsPeK0A03l1pGsHrjHE2h2nIrc1ifEm6 8ieyVD6ov3OVotBhbiY4nxOTbTVcLKr5usFiS+XugX1bpWzA1vfaiPjZh9i+CcY1 +4XKLtQWNuhiiugLo8h/+bP+id8nY++v2dCQYt28vJMCBkAOtmdc5Oxc/++6TO+m peb0eMTvgGejJBJXHP0xs+uRqUWOucENgZZvNt01ePxy9ZSvJ0k0b+wMHkVlgL98 WuiX5QAIH3UHBgbEDtERzcIxQSp23SpTnAnWpGLG8JIn7W9ZZ3EU++6ANQPXevlO yN6sUVz6EGukTbec7mIfnkAlPx2llHWanQbrGzyPgwfEzI2Bz09mAvpdcnkFIZnF x/YJ/g1/AfGoHE1vBxbY =FTnT -----END PGP SIGNATURE----- --Apple-Mail=_142B8DF5-710D-400F-B8EF-596FAC59DBD8-- From nobody Mon Dec 14 09:05:37 2015 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DD781ACD7A; Mon, 14 Dec 2015 09:05:34 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.11.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20151214170534.11198.66446.idtracker@ietfa.amsl.com> Date: Mon, 14 Dec 2015 09:05:34 -0800 Archived-At: Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-origin-validation-signaling-08.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2015 17:05:34 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. Title : BGP Prefix Origin Validation State Extended Community Authors : Pradosh Mohapatra Keyur Patel John Scudder Dave Ward Randy Bush Filename : draft-ietf-sidr-origin-validation-signaling-08.txt Pages : 5 Date : 2015-12-14 Abstract: This document defines a new BGP opaque extended community to carry the origination AS validation state inside an autonomous system. IBGP speakers that receive this validation state can configure local policies allowing it to influence their decision process. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-origin-validation-signaling/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-sidr-origin-validation-signaling-08 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-origin-validation-signaling-08 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Dec 14 09:10:19 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0203F1ACD86; Mon, 14 Dec 2015 09:10:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id If7eqhTkxtTN; Mon, 14 Dec 2015 09:10:14 -0800 (PST) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1bon0735.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::1:735]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9C121ACDA7; Mon, 14 Dec 2015 09:10:01 -0800 (PST) Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=jgs@juniper.net; Received: from [172.29.35.202] (66.129.241.13) by DM2PR05MB462.namprd05.prod.outlook.com (10.141.105.11) with Microsoft SMTP Server (TLS) id 15.1.337.19; Mon, 14 Dec 2015 17:09:39 +0000 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 (Mac OS X Mail 8.2 \(2104\)) From: "John G. Scudder" In-Reply-To: <20151214170534.11198.66446.idtracker@ietfa.amsl.com> Date: Mon, 14 Dec 2015 12:09:09 -0500 Content-Transfer-Encoding: quoted-printable Message-ID: References: <20151214170534.11198.66446.idtracker@ietfa.amsl.com> To: "sidr@ietf.org list" , idr wg X-Mailer: Apple Mail (2.2104) X-Originating-IP: [66.129.241.13] X-ClientProxiedBy: BY2PR08CA039.namprd08.prod.outlook.com (10.141.248.157) To DM2PR05MB462.namprd05.prod.outlook.com (10.141.105.11) X-Microsoft-Exchange-Diagnostics: 1; DM2PR05MB462; 2:20KoHaua4bDk5hLsf301C1YnMqs4U4G/cdiwO3nb24CH5FDMQh/S7bADYNTQ4kQ/IIp+J6FBfAcg17YhAAepMjgHGKQAeJbfwXKY+wlUpV3BTgYNj5cuq5ENlzomeiJDcMkQZtHWJwWmlWVrXZEgFQ==; 3:y8YAGeLzXsccbTAGKI8qwecZsrapm1HqDmT71Jn7lW3b2d188DPOPTT/GDpnI9E4hFYkWSmL/kU9pYOyR1K1L/j1Da0nWv+aSGxKd/PYVSoFa3SIMwsDkSQdzZ86ZSKu; 25:vEAT/0HMaJZHjT8vvSb4cEjU5LkGYHH/96HUzqUyLBEYZaEzzh2/6RudBK/B4ZwujYcMdUdeeMJ1aNOQ/kG/JaRDzMpoyn4yBmaJPHkX4vsjbaBGo9ZlyzFtldZGINx64mBqKdEKDZhlLf+FIeRx2z5eiNW8iBL2T5mwDU4xEZlbKDEjYwLTkptub1slborTdruxaY04EOwGL4Y39rmdcgoeu677pMN2tMohjHeUth0wjDuQSBC92QYMSmprKQnlvT+KF7IEjkegeKJVcuWFwA== X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DM2PR05MB462; X-Microsoft-Exchange-Diagnostics: 1; DM2PR05MB462; 20:hQt5waiRVl73oIPuEkzqs83CCOExMiYiH1ZLwghfyIr46fBvaVa0qZW11YgX8wPKKqVYIJXC2LY5oAjGdSECPq+1pSQJYVV75bk2LohRZ8t88Tw1546HfhDyIl7suxyEqVnr4Zq6cXEsabUiiMspvdp0Q8u5NRtA+nYC71T2sMxemo1FO8V/jJBwy5to/2un/sojjDuC99c9vHEEe7QUDTtLzXTEF3uujnfzA7KfKRI7ck4pZgoTMwh9xnCbQhF8UvX7Y115oolpBTsWmgMOLu5peWpkOfIA927ZOMGVNOjNlW1fs0kIBXldaSDOFHdXk7nCoInPwMnfWwbUN8mVSKmAD9dA2GQ3gxOV3uxj0GXlJeNr+fkTuoz/2kD3iRTVG6Kx6ybPE3FJbtXTzX2vNp1mo9ZoMHBCMwrIizizyuLikhzGtkO9HeFMmmzGlS7Rreqt8Qvt1XSKf0a7L2AwNvOsXSy6erpSg2LDIa5B4YhwXSz20qRP+JLRv+WmZuCh; 4:vkZkKczDh0/ZbMCVBEPCv7+iyUhRr1MeMghPc5gp0JaUY6J7UaHo7AfFwc3DSsDm6zV+BQy2TMrPVv9d36kgllT3ZTmJ9dT7iavF5jRQiuml1mQubZNIbvs8EIvtVvAr8/T4WKM+O0aM0gJ9o6xorsaeSA/3MkYfUNzaNmiAFi2yh8RaLa9Q6RsjnUgUGyksja/KoJVCIIVUIq/+9X5N/fJiFQjNaIyLUj5jUe7lMoohYNUrnJnSQZIvAD/N1Y8x27jJd4lOq2bjT0XiygTycMHfrOfIWsxCOwF3D2f8R98C9gBfK++iSsSw26b3WgECP7XRxOsTqLPXrsN406FYcADslAisRounI2NEH++EKLFNapnZf7LLgeBqD4a5ypYq X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(601004)(2401047)(5005006)(520078)(8121501046)(3002001)(10201501046); SRVR:DM2PR05MB462; BCL:0; PCL:0; RULEID:; SRVR:DM2PR05MB462; X-Forefront-PRVS: 0790FB1F33 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(6049001)(6009001)(377454003)(377424004)(53754006)(164054003)(24454002)(189002)(199003)(5008740100001)(450100001)(66066001)(33656002)(47776003)(87976001)(83716003)(586003)(23726003)(82746002)(1096002)(230783001)(50466002)(76176999)(3846002)(6116002)(101416001)(122386002)(40100003)(77096005)(81156007)(86362001)(50226001)(92566002)(42186005)(97756001)(46406003)(5001770100001)(36756003)(97736004)(50986999)(107886002)(2950100001)(5001960100002)(105586002)(189998001)(106356001)(19580405001)(4001150100001)(19580395003)(5004730100002)(57306001)(15975445007)(104396002)(42262002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR05MB462; H:[172.29.35.202]; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; Received-SPF: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; DM2PR05MB462; 23:JqvtOQBE6U7M+Wccr7A9jT2BTiFJbV9ZlxMl7CIN5V?= =?us-ascii?Q?fUj7fKsVoO7euIoYq9GFd1cGeym03eDdAQGuSTDhXuasPz16TPdPd5XFAUT8?= =?us-ascii?Q?DcKlp8zeCfaWN2srb0BhyWB/ACxJpeI+0XYyfxI+bCb/DPS3WsFquG5RCkw+?= =?us-ascii?Q?fj5cUkKY7J4V6uMvqhLsRQB6mzX5DftnioQLyPblFWkD528PqG8pevHLp5jG?= =?us-ascii?Q?0vGQMJwfXT0foZySHn8cFjgqaJ+2S2/D4QBsTfuT9dxABMK62RZ9SKKGnUCn?= =?us-ascii?Q?IlMwYdrvVEhdanG7foU9MtfczNIJpFHrOUYmKqognWq3pKbB4ZOsoLmo6wBa?= =?us-ascii?Q?AUJzooyhNlNf+2WzzPBR3MImQk5heo5v5qd17i6g6lIx1bYFZneMDzCZ+I+I?= =?us-ascii?Q?l77KJQ6eRM5cfq/m/TqTDNw4NX8eMzcoSJMBy7P538tOjrEggZHvVAvUjDof?= =?us-ascii?Q?Pui8CY0+l8O99uHtm6qwcRCyWC92eqryJONXhmTd6HAIBJbuQ0kuXK8M02ql?= =?us-ascii?Q?r8VRVW4a8dV+mvNL8iBLxKZaSUCmWBK08xrNrJ0oayip+Xc1+z9nDKUQ1MQV?= =?us-ascii?Q?8EdAIBTtDLi6nHp1xNemL+AyulnoEbvWfocZO5jduk+HUdxA8jIiGtE10sd8?= =?us-ascii?Q?efGJQo4xSTdcttv1aZEsUlhfjAh/iWe9E5HI14TaZ3K/YgU8myRIEPPpIAx3?= =?us-ascii?Q?jh6cQuY1gpQQ51LjnE6YxSGBR7uLDvLbnbGyweu2hSggrlmEVLlz7ftA3CYV?= =?us-ascii?Q?w6mvnvh/NJs5oq5H0YEA5UX7s8wkkx/mkkWD+lJxqCH7D8kxFCcydcX5Isah?= =?us-ascii?Q?+2pr1b3qtbWBgQWmZfIAdIUNh0qPCrmEAIoc1hxolTSxV8VEgTB9Dc2Ysi+j?= =?us-ascii?Q?YFsN6Np4NISJpwzDinQW22bF9lD0tSt17ywmVmJUjJ0S/9pxBsa6G/oFUJvP?= =?us-ascii?Q?JQf+oI/BP3CrZuB1J1pNI08hhtBi/k9RHOJIacqqRT2erPiVNG6aDLXHdtpg?= =?us-ascii?Q?TmRe0pKcEEdLMr7+DX82lt8ITBP5ZZfQLvgim8srr4qQzgs7EfBz6MdbzXMZ?= =?us-ascii?Q?SfcGt41Ku4bVIUEB1xBJk1PL1T7O7DOY+p6Kgj1bffiM6H9LAN21t3FDGa+w?= =?us-ascii?Q?t76vtEmtYKworXkfnyxNfeSTwkTDVNnWy6OZWpqwcHUqrR1jEShCjn2E8AsO?= =?us-ascii?Q?prSxeRclIp48URJ1i1Tk8dvlJ67MHBg7PqtzkoZ1Ma4Byv7+sDjFYfeM4ErM?= =?us-ascii?Q?ZSQny4IC4YWq1I8HbYNt7GJjoS83TATdQpi7YPYY1lNZQWyqskONp780nA18?= =?us-ascii?Q?yJUqtXZdHLvUDh0jqZRLeUrw4om2ru/eizyE66ilGR9quTs0Fi3825Z3yN7E?= =?us-ascii?Q?bXizat14NYpxMbm//ymyQqQSpLm+v6sp1+eYCuYm470YMB?= X-Microsoft-Exchange-Diagnostics: 1; DM2PR05MB462; 5:1PuIrB1BAnalQZHaWF+Y6vDYWLQ9e/mx4qKQfT8+9Zuv/OeK37aVzGXM007VdAlWyZanmEGD+tuII5I5MlZR05qDms1ngaQnqLjSRz1CjTF0fNOxuTBffTRLqo7IOwRElGpiazQ8nXL7Om6wxEq20A==; 24:YXkJ7kdMN+g8DShYuUQTnjhcC32U/ZApTWfGRCmDhYPsN+OAU1bULRj2WAevNKGv4O/KQo93ljZk8WMVFt1BpdlOGteXAAxIu+kclXhuJGo= SpamDiagnosticOutput: 1:23 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Dec 2015 17:09:39.7173 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR05MB462 Archived-At: Subject: Re: [sidr] I-D Action: draft-ietf-sidr-origin-validation-signaling-08.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2015 17:10:17 -0000 Hi Everybody, Just when we thought we were completely done with this draft, we were = approached by Thomas King who pointed out a use case that can be enabled = by validation signaling, which benefits from a minor revision in the = language of the draft. Here's the revision: OLD: By default, implementations SHOULD drop the origin validation state extended community if received from an EBGP peer, without further processing it. However an implementation MAY be configured to accept the community when warranted, for example when the EBGP session is to a neighbor AS under control of the same administration. Similarly, an implementation SHOULD NOT send the community to EBGP peers but MAY be configured to do so if warranted. NEW: By default, implementations SHOULD drop the origin validation state extended community if received from an EBGP peer, without further processing it. Similarly, by default an implementation SHOULD NOT send the community to EBGP peers. However it SHOULD be possible to configure an implementation to send or accept the community when warranted. An example of a case where the community would reasonably be received from, or sent to, an EBGP peer is when two adjacent ASes are under control of the same administration. A second example is documented in [I-D.kklf-sidr-route-server-rpki-light]. The change does two things. One is to add an informative reference to = Thomas's draft. The second is a change in emphasis. Whereas we formerly = said that an implementation MAY be configured to send and/or receive the = community over EBGP, now we say it SHOULD be possible to configure it to = do that. I'm hoping this change will be noncontroversial and we can continue to = move forward towards RFC, however I anticipate the respective working = group chairs of SIDR and IDR (for obvious reasons I'm recusing myself) = may want to have a period to allow people to comment. Thanks, --John > On Dec 14, 2015, at 12:05 PM, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Secure Inter-Domain Routing Working = Group of the IETF. >=20 > Title : BGP Prefix Origin Validation State Extended = Community > Authors : Pradosh Mohapatra > Keyur Patel > John Scudder > Dave Ward > Randy Bush > Filename : = draft-ietf-sidr-origin-validation-signaling-08.txt > Pages : 5 > Date : 2015-12-14 >=20 > Abstract: > This document defines a new BGP opaque extended community to carry > the origination AS validation state inside an autonomous system. > IBGP speakers that receive this validation state can configure local > policies allowing it to influence their decision process. >=20 >=20 > The IETF datatracker status page for this draft is: > = https://datatracker.ietf.org/doc/draft-ietf-sidr-origin-validation-signali= ng/ >=20 > There's also a htmlized version available at: > = https://tools.ietf.org/html/draft-ietf-sidr-origin-validation-signaling-08= >=20 > A diff from the previous version is available at: > = https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-origin-validation-sign= aling-08 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From nobody Mon Dec 14 09:50:14 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 810D11ACEBA; Mon, 14 Dec 2015 09:50:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.578 X-Spam-Level: X-Spam-Status: No, score=-1.578 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, IP_NOT_FRIENDLY=0.334, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iPtjfvyzD939; Mon, 14 Dec 2015 09:50:10 -0800 (PST) Received: from slice.pfrc.org (slice.pfrc.org [67.207.130.108]) by ietfa.amsl.com (Postfix) with ESMTP id B8E281ACEAF; Mon, 14 Dec 2015 09:50:10 -0800 (PST) Received: by slice.pfrc.org (Postfix, from userid 1001) id EC3CA1E45D; Mon, 14 Dec 2015 12:51:28 -0500 (EST) Date: Mon, 14 Dec 2015 12:51:28 -0500 From: Jeffrey Haas To: "John G. Scudder" Message-ID: <20151214175128.GA28772@pfrc.org> References: <20151214170534.11198.66446.idtracker@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Archived-At: Cc: idr wg , "sidr@ietf.org list" Subject: Re: [sidr] [Idr] I-D Action: draft-ietf-sidr-origin-validation-signaling-08.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Dec 2015 17:50:11 -0000 On Mon, Dec 14, 2015 at 12:09:09PM -0500, John G. Scudder wrote: > Hi Everybody, > > Just when we thought we were completely done with this draft, we were approached by Thomas King who pointed out a use case that can be enabled by validation signaling, which benefits from a minor revision in the language of the draft. Here's the revision: [...] > NEW: > By default, implementations SHOULD drop the origin validation state > extended community if received from an EBGP peer, without further > processing it. Similarly, by default an implementation SHOULD NOT > send the community to EBGP peers. However it SHOULD be possible to > configure an implementation to send or accept the community when > warranted. An example of a case where the community would reasonably > be received from, or sent to, an EBGP peer is when two adjacent ASes > are under control of the same administration. A second example is > documented in [I-D.kklf-sidr-route-server-rpki-light]. > > The change does two things. One is to add an informative reference to Thomas's draft. The second is a change in emphasis. Whereas we formerly said that an implementation MAY be configured to send and/or receive the community over EBGP, now we say it SHOULD be possible to configure it to do that. For what it's worth, I'm highly supportive of this. (In spite of the fact that it's going to make me change code...) We're seeing a generalized trend toward "if your feature says eBGP, you might relax it in the following circumstances". Pity confederations never caught on. -- Jeff From nobody Tue Dec 15 00:48:17 2015 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 989751A00CD; Tue, 15 Dec 2015 00:48:14 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.11.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20151215084814.19302.71570.idtracker@ietfa.amsl.com> Date: Tue, 15 Dec 2015 00:48:14 -0800 Archived-At: Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-bgpsec-ops-07.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Dec 2015 08:48:14 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. Title : BGPsec Operational Considerations Author : Randy Bush Filename : draft-ietf-sidr-bgpsec-ops-07.txt Pages : 8 Date : 2015-12-15 Abstract: Deployment of the BGPsec architecture and protocols has many operational considerations. This document attempts to collect and present the most critical and universal. It is expected to evolve as BGPsec is formalized and initially deployed. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-ops/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-sidr-bgpsec-ops-07 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-bgpsec-ops-07 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Dec 15 00:58:51 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1B071A00FD for ; Tue, 15 Dec 2015 00:58:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GCD10B60aCjv for ; Tue, 15 Dec 2015 00:58:49 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE1B11A00C3 for ; Tue, 15 Dec 2015 00:58:49 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.82) (envelope-from ) id 1a8lRY-0006tZ-9z for sidr@ietf.org; Tue, 15 Dec 2015 08:58:48 +0000 Date: Tue, 15 Dec 2015 17:58:46 +0900 Message-ID: From: Randy Bush To: sidr wg list In-Reply-To: <20151215084814.19302.71570.idtracker@ietfa.amsl.com> References: <20151215084814.19302.71570.idtracker@ietfa.amsl.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-ops-07.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Dec 2015 08:58:51 -0000 thomas king and arnold nipper pointed out an omission which this fills A route server is usually 'transparent', most importantly not inserting its own AS into the AS_Path, to not lengthen the AS hop count and thereby reduce the likelihood of best path selection. See 2.2.2 of [I-D.ietf-idr-ix-bgp-route-server]. A BGPsec-aware route server needs to validate the incoming BGPSEC_Path, and to forward updates which can be validated by clients which know the route server's AS. The route server uses pCount of zero to not increase the effective AS hop count. randy From nobody Tue Dec 15 01:04:20 2015 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E41151A0113; Tue, 15 Dec 2015 01:04:17 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.11.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20151215090417.7744.12491.idtracker@ietfa.amsl.com> Date: Tue, 15 Dec 2015 01:04:17 -0800 Archived-At: Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-lta-use-cases-04.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Dec 2015 09:04:18 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. Title : RPKI Local Trust Anchor Use Cases Author : Randy Bush Filename : draft-ietf-sidr-lta-use-cases-04.txt Pages : 5 Date : 2015-12-15 Abstract: There are a number of critical circumstances where a localized routing domain needs to augment or modify its view of the Global RPKI. This document attempts to outline a few of them. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-lta-use-cases/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-sidr-lta-use-cases-04 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-lta-use-cases-04 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Dec 15 01:44:34 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EF581A038C for ; Tue, 15 Dec 2015 01:44:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r2h85vGnjBsJ for ; Tue, 15 Dec 2015 01:44:32 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91FF41A0389 for ; Tue, 15 Dec 2015 01:44:32 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com) by ran.psg.com with esmtp (Exim 4.82) (envelope-from ) id 1a8m9n-00073C-7Z for sidr@ietf.org; Tue, 15 Dec 2015 09:44:31 +0000 Date: Tue, 15 Dec 2015 18:44:30 +0900 Message-ID: From: Randy Bush To: sidr@ietf.org In-Reply-To: <20151215090417.7744.12491.idtracker@ietfa.amsl.com> References: <20151215090417.7744.12491.idtracker@ietfa.amsl.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [sidr] I-D Action: draft-ietf-sidr-lta-use-cases-04.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Dec 2015 09:44:33 -0000 don't panic, it's just an expiry refresh :) From nobody Tue Dec 15 06:08:34 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43E7F1A899C; Tue, 15 Dec 2015 06:08:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.51 X-Spam-Level: X-Spam-Status: No, score=-14.51 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o8cmKmReNBJ0; Tue, 15 Dec 2015 06:08:29 -0800 (PST) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 532F61A899A; Tue, 15 Dec 2015 06:08:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5778; q=dns/txt; s=iport; t=1450188509; x=1451398109; h=from:to:subject:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version; bh=d3JfcbJlpx2GjPu9Jv6QsdSPydMk0L4n+KmISVLrs24=; b=YowqKR1d/DwRXbZ40mX/N44cEe4DYeIOtoTCIUZ46jqsx8waNA0cnZYX o2uOvucz/NmFxD24IBJCortFUThnT3eTAVp74xUveC25AUpobjCIBKwup kWTg5CBUPyRGsmevl3mv/dEICZ+TtH+QEDugx9WRFcj9MOrUXDYDqYe3i c=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AjAgDgHXBW/4kNJK1egzpSbQa9UwENg?= =?us-ascii?q?WMXDIVqAhyBIzgUAQEBAQEBAYEKhDUBAQQBAQEgETobAgEIGAICJgICAiULFRA?= =?us-ascii?q?CBAESFIgbDqtckgsBAQEBAQEBAQEBAQEBAQEBAQEBGoEBilKEQhcYgwaBSQWWf?= =?us-ascii?q?AGFOIgPgVxJg3yWeAEfAQFCghEdgVZygykCBRkHHIEIAQEB?= X-IronPort-AV: E=Sophos;i="5.20,432,1444694400"; d="scan'208";a="53790236" Received: from alln-core-4.cisco.com ([173.36.13.137]) by rcdn-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 15 Dec 2015 14:08:28 +0000 Received: from XCH-RTP-012.cisco.com (xch-rtp-012.cisco.com [64.101.220.152]) by alln-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id tBFE8Hpc006611 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 15 Dec 2015 14:08:27 GMT Received: from xch-rtp-015.cisco.com (64.101.220.155) by XCH-RTP-012.cisco.com (64.101.220.152) with Microsoft SMTP Server (TLS) id 15.0.1104.5; Tue, 15 Dec 2015 09:08:16 -0500 Received: from xch-rtp-015.cisco.com ([64.101.220.155]) by XCH-RTP-015.cisco.com ([64.101.220.155]) with mapi id 15.00.1104.009; Tue, 15 Dec 2015 09:08:16 -0500 From: "Acee Lindem (acee)" To: "John G. Scudder" , "sidr@ietf.org list" , idr wg Thread-Topic: [Idr] [sidr] I-D Action: draft-ietf-sidr-origin-validation-signaling-08.txt Thread-Index: AQHRNpJZKOS/snRul02eHl9fir07eJ7MFuwA Date: Tue, 15 Dec 2015 14:08:16 +0000 Message-ID: References: <20151214170534.11198.66446.idtracker@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.116.152.199] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [sidr] [Idr] I-D Action: draft-ietf-sidr-origin-validation-signaling-08.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Dec 2015 14:08:31 -0000 SSBzdXBwb3J0IGFsbG93aW5nIHVzYWdlIG92ZXIgRUJHUCBzZXNzaW9ucy4NClRoYW5rcywNCkFj ZWUgDQoNCk9uIDEyLzE0LzE1LCAxMjowOSBQTSwgIklkciBvbiBiZWhhbGYgb2YgSm9obiBHLiBT Y3VkZGVyIg0KPGlkci1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBqZ3NAanVuaXBlci5u ZXQ+IHdyb3RlOg0KDQo+SGkgRXZlcnlib2R5LA0KPg0KPkp1c3Qgd2hlbiB3ZSB0aG91Z2h0IHdl IHdlcmUgY29tcGxldGVseSBkb25lIHdpdGggdGhpcyBkcmFmdCwgd2Ugd2VyZQ0KPmFwcHJvYWNo ZWQgYnkgVGhvbWFzIEtpbmcgd2hvIHBvaW50ZWQgb3V0IGEgdXNlIGNhc2UgdGhhdCBjYW4gYmUg ZW5hYmxlZA0KPmJ5IHZhbGlkYXRpb24gc2lnbmFsaW5nLCB3aGljaCBiZW5lZml0cyBmcm9tIGEg bWlub3IgcmV2aXNpb24gaW4gdGhlDQo+bGFuZ3VhZ2Ugb2YgdGhlIGRyYWZ0LiBIZXJlJ3MgdGhl IHJldmlzaW9uOg0KPg0KPk9MRDoNCj4gICBCeSBkZWZhdWx0LCBpbXBsZW1lbnRhdGlvbnMgU0hP VUxEIGRyb3AgdGhlIG9yaWdpbiB2YWxpZGF0aW9uIHN0YXRlDQo+ICAgZXh0ZW5kZWQgY29tbXVu aXR5IGlmIHJlY2VpdmVkIGZyb20gYW4gRUJHUCBwZWVyLCB3aXRob3V0IGZ1cnRoZXINCj4gICBw cm9jZXNzaW5nIGl0LiAgSG93ZXZlciBhbiBpbXBsZW1lbnRhdGlvbiBNQVkgYmUgY29uZmlndXJl ZCB0byBhY2NlcHQNCj4gICB0aGUgY29tbXVuaXR5IHdoZW4gd2FycmFudGVkLCBmb3IgZXhhbXBs ZSB3aGVuIHRoZSBFQkdQIHNlc3Npb24gaXMgdG8NCj4gICBhIG5laWdoYm9yIEFTIHVuZGVyIGNv bnRyb2wgb2YgdGhlIHNhbWUgYWRtaW5pc3RyYXRpb24uICBTaW1pbGFybHksDQo+ICAgYW4gaW1w bGVtZW50YXRpb24gU0hPVUxEIE5PVCBzZW5kIHRoZSBjb21tdW5pdHkgdG8gRUJHUCBwZWVycyBi dXQgTUFZDQo+ICAgYmUgY29uZmlndXJlZCB0byBkbyBzbyBpZiB3YXJyYW50ZWQuDQo+DQo+TkVX Og0KPiAgIEJ5IGRlZmF1bHQsIGltcGxlbWVudGF0aW9ucyBTSE9VTEQgZHJvcCB0aGUgb3JpZ2lu IHZhbGlkYXRpb24gc3RhdGUNCj4gICBleHRlbmRlZCBjb21tdW5pdHkgaWYgcmVjZWl2ZWQgZnJv bSBhbiBFQkdQIHBlZXIsIHdpdGhvdXQgZnVydGhlcg0KPiAgIHByb2Nlc3NpbmcgaXQuICBTaW1p bGFybHksIGJ5IGRlZmF1bHQgYW4gaW1wbGVtZW50YXRpb24gU0hPVUxEIE5PVA0KPiAgIHNlbmQg dGhlIGNvbW11bml0eSB0byBFQkdQIHBlZXJzLiAgSG93ZXZlciBpdCBTSE9VTEQgYmUgcG9zc2li bGUgdG8NCj4gICBjb25maWd1cmUgYW4gaW1wbGVtZW50YXRpb24gdG8gc2VuZCBvciBhY2NlcHQg dGhlIGNvbW11bml0eSB3aGVuDQo+ICAgd2FycmFudGVkLiAgQW4gZXhhbXBsZSBvZiBhIGNhc2Ug d2hlcmUgdGhlIGNvbW11bml0eSB3b3VsZCByZWFzb25hYmx5DQo+ICAgYmUgcmVjZWl2ZWQgZnJv bSwgb3Igc2VudCB0bywgYW4gRUJHUCBwZWVyIGlzIHdoZW4gdHdvIGFkamFjZW50IEFTZXMNCj4g ICBhcmUgdW5kZXIgY29udHJvbCBvZiB0aGUgc2FtZSBhZG1pbmlzdHJhdGlvbi4gIEEgc2Vjb25k IGV4YW1wbGUgaXMNCj4gICBkb2N1bWVudGVkIGluIFtJLUQua2tsZi1zaWRyLXJvdXRlLXNlcnZl ci1ycGtpLWxpZ2h0XS4NCj4NCj5UaGUgY2hhbmdlIGRvZXMgdHdvIHRoaW5ncy4gT25lIGlzIHRv IGFkZCBhbiBpbmZvcm1hdGl2ZSByZWZlcmVuY2UgdG8NCj5UaG9tYXMncyBkcmFmdC4gVGhlIHNl Y29uZCBpcyBhIGNoYW5nZSBpbiBlbXBoYXNpcy4gV2hlcmVhcyB3ZSBmb3JtZXJseQ0KPnNhaWQg dGhhdCBhbiBpbXBsZW1lbnRhdGlvbiBNQVkgYmUgY29uZmlndXJlZCB0byBzZW5kIGFuZC9vciBy ZWNlaXZlIHRoZQ0KPmNvbW11bml0eSBvdmVyIEVCR1AsIG5vdyB3ZSBzYXkgaXQgU0hPVUxEIGJl IHBvc3NpYmxlIHRvIGNvbmZpZ3VyZSBpdCB0bw0KPmRvIHRoYXQuDQo+DQo+SSdtIGhvcGluZyB0 aGlzIGNoYW5nZSB3aWxsIGJlIG5vbmNvbnRyb3ZlcnNpYWwgYW5kIHdlIGNhbiBjb250aW51ZSB0 bw0KPm1vdmUgZm9yd2FyZCB0b3dhcmRzIFJGQywgaG93ZXZlciBJIGFudGljaXBhdGUgdGhlIHJl c3BlY3RpdmUgd29ya2luZw0KPmdyb3VwIGNoYWlycyBvZiBTSURSIGFuZCBJRFIgKGZvciBvYnZp b3VzIHJlYXNvbnMgSSdtIHJlY3VzaW5nIG15c2VsZikNCj5tYXkgd2FudCB0byBoYXZlIGEgcGVy aW9kIHRvIGFsbG93IHBlb3BsZSB0byBjb21tZW50Lg0KPg0KPlRoYW5rcywNCj4NCj4tLUpvaG4N Cj4NCj4+IE9uIERlYyAxNCwgMjAxNSwgYXQgMTI6MDUgUE0sIGludGVybmV0LWRyYWZ0c0BpZXRm Lm9yZyB3cm90ZToNCj4+IA0KPj4gDQo+PiBBIE5ldyBJbnRlcm5ldC1EcmFmdCBpcyBhdmFpbGFi bGUgZnJvbSB0aGUgb24tbGluZSBJbnRlcm5ldC1EcmFmdHMNCj4+ZGlyZWN0b3JpZXMuDQo+PiBU aGlzIGRyYWZ0IGlzIGEgd29yayBpdGVtIG9mIHRoZSBTZWN1cmUgSW50ZXItRG9tYWluIFJvdXRp bmcgV29ya2luZw0KPj5Hcm91cCBvZiB0aGUgSUVURi4NCj4+IA0KPj4gICAgICAgIFRpdGxlICAg ICAgICAgICA6IEJHUCBQcmVmaXggT3JpZ2luIFZhbGlkYXRpb24gU3RhdGUgRXh0ZW5kZWQNCj4+ Q29tbXVuaXR5DQo+PiAgICAgICAgQXV0aG9ycyAgICAgICAgIDogUHJhZG9zaCBNb2hhcGF0cmEN Cj4+ICAgICAgICAgICAgICAgICAgICAgICAgICBLZXl1ciBQYXRlbA0KPj4gICAgICAgICAgICAg ICAgICAgICAgICAgIEpvaG4gU2N1ZGRlcg0KPj4gICAgICAgICAgICAgICAgICAgICAgICAgIERh dmUgV2FyZA0KPj4gICAgICAgICAgICAgICAgICAgICAgICAgIFJhbmR5IEJ1c2gNCj4+IAlGaWxl bmFtZSAgICAgICAgOiBkcmFmdC1pZXRmLXNpZHItb3JpZ2luLXZhbGlkYXRpb24tc2lnbmFsaW5n LTA4LnR4dA0KPj4gCVBhZ2VzICAgICAgICAgICA6IDUNCj4+IAlEYXRlICAgICAgICAgICAgOiAy MDE1LTEyLTE0DQo+PiANCj4+IEFic3RyYWN0Og0KPj4gICBUaGlzIGRvY3VtZW50IGRlZmluZXMg YSBuZXcgQkdQIG9wYXF1ZSBleHRlbmRlZCBjb21tdW5pdHkgdG8gY2FycnkNCj4+ICAgdGhlIG9y aWdpbmF0aW9uIEFTIHZhbGlkYXRpb24gc3RhdGUgaW5zaWRlIGFuIGF1dG9ub21vdXMgc3lzdGVt Lg0KPj4gICBJQkdQIHNwZWFrZXJzIHRoYXQgcmVjZWl2ZSB0aGlzIHZhbGlkYXRpb24gc3RhdGUg Y2FuIGNvbmZpZ3VyZSBsb2NhbA0KPj4gICBwb2xpY2llcyBhbGxvd2luZyBpdCB0byBpbmZsdWVu Y2UgdGhlaXIgZGVjaXNpb24gcHJvY2Vzcy4NCj4+IA0KPj4gDQo+PiBUaGUgSUVURiBkYXRhdHJh Y2tlciBzdGF0dXMgcGFnZSBmb3IgdGhpcyBkcmFmdCBpczoNCj4+IA0KPj5odHRwczovL2RhdGF0 cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLXNpZHItb3JpZ2luLXZhbGlkYXRpb24tc2ln bmFsDQo+PmluZy8NCj4+IA0KPj4gVGhlcmUncyBhbHNvIGEgaHRtbGl6ZWQgdmVyc2lvbiBhdmFp bGFibGUgYXQ6DQo+PiANCj4+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYt c2lkci1vcmlnaW4tdmFsaWRhdGlvbi1zaWduYWxpbmctMA0KPj44DQo+PiANCj4+IEEgZGlmZiBm cm9tIHRoZSBwcmV2aW91cyB2ZXJzaW9uIGlzIGF2YWlsYWJsZSBhdDoNCj4+IA0KPj5odHRwczov L3d3dy5pZXRmLm9yZy9yZmNkaWZmP3VybDI9ZHJhZnQtaWV0Zi1zaWRyLW9yaWdpbi12YWxpZGF0 aW9uLXNpZ25hDQo+PmxpbmctMDgNCj4+IA0KPj4gDQo+PiBQbGVhc2Ugbm90ZSB0aGF0IGl0IG1h eSB0YWtlIGEgY291cGxlIG9mIG1pbnV0ZXMgZnJvbSB0aGUgdGltZSBvZg0KPj5zdWJtaXNzaW9u DQo+PiB1bnRpbCB0aGUgaHRtbGl6ZWQgdmVyc2lvbiBhbmQgZGlmZiBhcmUgYXZhaWxhYmxlIGF0 IHRvb2xzLmlldGYub3JnLg0KPj4gDQo+PiBJbnRlcm5ldC1EcmFmdHMgYXJlIGFsc28gYXZhaWxh YmxlIGJ5IGFub255bW91cyBGVFAgYXQ6DQo+PiBmdHA6Ly9mdHAuaWV0Zi5vcmcvaW50ZXJuZXQt ZHJhZnRzLw0KPj4gDQo+PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KPj4gc2lkciBtYWlsaW5nIGxpc3QNCj4+IHNpZHJAaWV0Zi5vcmcNCj4+IGh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc2lkcg0KPg0KPl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+SWRyIG1haWxpbmcgbGlzdA0KPklk ckBpZXRmLm9yZw0KPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWRyDQoN Cg== From nobody Tue Dec 15 09:42:49 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 183031A8F3D for ; Tue, 15 Dec 2015 09:42:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W0dJCsir1Lcn for ; Tue, 15 Dec 2015 09:42:47 -0800 (PST) Received: from adrilankha.hactrn.net (adrilankha.hactrn.net [IPv6:2001:418:1::19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D88401A9105 for ; Tue, 15 Dec 2015 09:42:46 -0800 (PST) Received: from minas-ithil.hactrn.net (c-24-34-34-16.hsd1.ma.comcast.net [24.34.34.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "nargothrond.hactrn.net", Issuer "Grunchweather Associates" (verified OK)) by adrilankha.hactrn.net (Postfix) with ESMTPS id 65D8C398C6; Tue, 15 Dec 2015 17:42:46 +0000 (UTC) Received: from minas-ithil.hactrn.net (localhost [IPv6:::1]) by minas-ithil.hactrn.net (Postfix) with ESMTP id 2971B290DD66; Tue, 15 Dec 2015 12:42:46 -0500 (EST) Date: Tue, 15 Dec 2015 12:42:46 -0500 From: Rob Austein To: Sandra Murphy In-Reply-To: References: User-Agent: Wanderlust/2.15.5 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Message-Id: <20151215174246.2971B290DD66@minas-ithil.hactrn.net> Archived-At: Cc: sidr Subject: Re: [sidr] wg adoption call for draft-tbruijnzeels-sidr-validation-local-cache-02 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Dec 2015 17:42:48 -0000 At Wed, 9 Dec 2015 18:08:14 -0500, Sandra Murphy wrote: > > As noted in the minutes, the authors of > draft-tbruijnzeels-sidr-validation-local-cache-02 request that the > working group adopt this work as a wg work item. ... > Please respond on the list to say whether you support adoption of > this work as a working group work item AND whether you will > participate in the discussion. I have read this and support adoption. I found myself walking down this same road when I started thinking about how to implement RRDP, so I think we need this. From nobody Tue Dec 15 13:04:24 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9072C1ACDD1 for ; Tue, 15 Dec 2015 13:04:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dPVn_e0xUh01 for ; Tue, 15 Dec 2015 13:04:22 -0800 (PST) Received: from mail-vk0-x235.google.com (mail-vk0-x235.google.com [IPv6:2607:f8b0:400c:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E1941ACDD2 for ; Tue, 15 Dec 2015 13:04:22 -0800 (PST) Received: by mail-vk0-x235.google.com with SMTP id a189so14035567vkh.2 for ; Tue, 15 Dec 2015 13:04:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=reply-to:subject:references:to:from:message-id:date:user-agent :mime-version:in-reply-to:content-type:content-transfer-encoding; bh=3BLxPYo0frN7e38p4Vj/Tkjeh60fg0LUCSiJe4UnqMA=; b=QMj/nlgK0NVVXUfZdc7VE1Pp60gZY3luC/y7aeDugBEnnOhcTZz+ejW+GNjMRP0ZzB IcrPyZ6UlP45Z+5/5js0HsHmDs4fyan+SfM1XJ92ykqo050Pn9BTgfoh/MV5xSooDxZE rnE+a9eCgqUWZNwyL3wMGRShC2LLTSIrK04WiYrhAXrDV4vjLZsweY3Kc/O9Gb2mD3xW McWeDAqfZj+dcxvaN/CLXKJ3clFddIjaPs04SN2/C7XXr735hr7Jjt1KElR/axFKtcyj kn9yGQ6pVC65mJ/VeWHXG9kw2he4p95Y7gAiELFf175i+sTYfd6ca/eZa094w3Nqczx6 J1Vw== X-Received: by 10.31.2.82 with SMTP id 79mr11822199vkc.22.1450213461337; Tue, 15 Dec 2015 13:04:21 -0800 (PST) Received: from erebus.local ([2001:13c7:7001:2128:a1d3:a821:c9f1:6c4b]) by smtp.googlemail.com with ESMTPSA id c190sm275700vkc.16.2015.12.15.13.04.20 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 15 Dec 2015 13:04:20 -0800 (PST) References: To: Sandra Murphy , sidr From: "Carlos M. Martinez" Message-ID: <56708051.2090808@gmail.com> Date: Tue, 15 Dec 2015 18:04:17 -0300 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [sidr] wg adoption call for draft-tbruijnzeels-sidr-validation-local-cache-02 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: carlos@lacnic.net List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Dec 2015 21:04:23 -0000 Read and support. On 12/9/15 8:08 PM, Sandra Murphy wrote: > As noted in the minutes, the authors of draft-tbruijnzeels-sidr-validation-local-cache-02 request that the working group adopt this work as a wg work item. > > A working group adoption poll starts now and will end 14 days from now on 23 December. > > Please respond on the list to say whether you support adoption of this work as a working group work item AND whether you will participate in the discussion. > > Remember that working group consensus to adopt the work needs responses, not just absence of objection, so speak up. > > --Sandy, speaking as one of the wg co-chairs > > > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From nobody Tue Dec 15 14:25:28 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 333211A8AF1 for ; Tue, 15 Dec 2015 14:25:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hMbUmvYI7XZs for ; Tue, 15 Dec 2015 14:25:25 -0800 (PST) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C0B8A1A702F for ; Tue, 15 Dec 2015 14:25:25 -0800 (PST) Received: from ssh.bbn.com ([192.1.122.15]:56782 helo=COMSEC.fios-router.home) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1a8y28-000GFN-Fp for sidr@ietf.org; Tue, 15 Dec 2015 17:25:24 -0500 From: Stephen Kent To: sidr@ietf.org References: Message-ID: <56709354.6080006@bbn.com> Date: Tue, 15 Dec 2015 17:25:24 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------030601090109050006050101" Archived-At: Subject: Re: [sidr] wg adoption call for draft-tbruijnzeels-sidr-validation-local-cache-02 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Dec 2015 22:25:27 -0000 This is a multi-part message in MIME format. --------------030601090109050006050101 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit I think we ought to have a document that describes how an RP can manage a local cache, since we usually say that we expect RPs to do so. However, this document seems to be a description of only one implementation's approach to local cache management. I'd be more comfortable with a document that is co-authored by the developers of the three major RP implementations. Steve > As noted in the minutes, the authors of draft-tbruijnzeels-sidr-validation-local-cache-02 request that the working group adopt this work as a wg work item. > > A working group adoption poll starts now and will end 14 days from now on 23 December. > > Please respond on the list to say whether you support adoption of this work as a working group work item AND whether you will participate in the discussion. > > Remember that working group consensus to adopt the work needs responses, not just absence of objection, so speak up. > > --Sandy, speaking as one of the wg co-chairs > > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr --------------030601090109050006050101 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit I think we ought to have a document that describes how an RP can manage a local
cache, since we usually say that we expect RPs to do so. However, this document
seems to be a description of only one implementation's approach to local cache
management. I'd be more comfortable with a document that is co-authored by
the developers of the three major RP implementations.

Steve
As noted in the minutes, the authors of draft-tbruijnzeels-sidr-validation-local-cache-02 request that the working group adopt this work as a wg work item.

A working group adoption poll starts now and will end 14 days from now on 23 December.

Please respond on the list to say whether you support adoption of this work as a working group work item AND whether you will participate in the discussion.

Remember that working group consensus to adopt the work needs responses, not just absence of objection, so speak up.

--Sandy, speaking as one of the wg co-chairs



_______________________________________________
sidr mailing list
sidr@ietf.org
https://www.ietf.org/mailman/listinfo/sidr

--------------030601090109050006050101-- From nobody Wed Dec 16 02:30:58 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 073671ACE44 for ; Wed, 16 Dec 2015 02:30:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FxTlM6uPROSW for ; Wed, 16 Dec 2015 02:30:55 -0800 (PST) Received: from molamola.ripe.net (molamola.ripe.net [IPv6:2001:67c:2e8:11::c100:1371]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86A531ACE42 for ; Wed, 16 Dec 2015 02:30:55 -0800 (PST) Received: from titi.ripe.net ([193.0.23.11]) by molamola.ripe.net with esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.84) (envelope-from ) id 1a99M7-0000Cc-LQ; Wed, 16 Dec 2015 11:30:49 +0100 Received: from sslvpn.ripe.net ([193.0.20.230] helo=vpn-1.ripe.net) by titi.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1a99M7-00010p-GY; Wed, 16 Dec 2015 11:30:47 +0100 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\)) Content-Type: text/plain; charset=us-ascii From: Tim Bruijnzeels In-Reply-To: <56709354.6080006@bbn.com> Date: Wed, 16 Dec 2015 11:30:47 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: <26C6CEB6-D858-4AC4-BC6E-3B3A8927CE03@ripe.net> References: <56709354.6080006@bbn.com> To: Stephen Kent X-Mailer: Apple Mail (2.2104) X-ACL-Warn: Delaying message X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a0719f4299181a30b74cec0defa3768693ee5 Archived-At: Cc: sidr@ietf.org Subject: Re: [sidr] wg adoption call for draft-tbruijnzeels-sidr-validation-local-cache-02 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Dec 2015 10:30:57 -0000 Hi Steve, group, I agree that it would be useful to have a standards track document = co-authored by the three major implementors. But this document is intended as an informational track document to = describe our implementation only, so that: - it can be scrutinised - we can refer to it to explain how our implementation works - it can server as an example, not standard, on how this can work It may very well be that parts of this exercise are useful to feed into = another, standards track and implementation agnostic, document later. I = believe that Rob already expressed interest in this - long term, but he = can correct me of course :) In short: I see your point, but I don't believe the efforts are mutually = exclusive. Tim > On 15 Dec 2015, at 23:25, Stephen Kent wrote: >=20 > I think we ought to have a document that describes how an RP can = manage a local > cache, since we usually say that we expect RPs to do so. However, this = document=20 > seems to be a description of only one implementation's approach to = local cache > management. I'd be more comfortable with a document that is = co-authored by > the developers of the three major RP implementations. >=20 > Steve >> As noted in the minutes, the authors of = draft-tbruijnzeels-sidr-validation-local-cache-02 request that the = working group adopt this work as a wg work item. >>=20 >> A working group adoption poll starts now and will end 14 days from = now on 23 December. >>=20 >> Please respond on the list to say whether you support adoption of = this work as a working group work item AND whether you will participate = in the discussion. >>=20 >> Remember that working group consensus to adopt the work needs = responses, not just absence of objection, so speak up. >>=20 >> --Sandy, speaking as one of the wg co-chairs >>=20 >>=20 >>=20 >> _______________________________________________ >> sidr mailing list >>=20 >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From nobody Wed Dec 16 08:43:16 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F06651A0451 for ; Wed, 16 Dec 2015 08:43:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FMWz3AzgvQzo for ; Wed, 16 Dec 2015 08:43:13 -0800 (PST) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7B3FD1A0108 for ; Wed, 16 Dec 2015 08:43:13 -0800 (PST) Received: by mail-qk0-x235.google.com with SMTP id t125so72609275qkh.3 for ; Wed, 16 Dec 2015 08:43:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=FiUoa/twLnMmcs88mTMjYJHEJ0oj1jDGS/ns9L/+i10=; b=F7GhjluLumCPPr9/0gaJZmGITvFHnd8nrYNlPK/Vnyx2jf7DfU8QV7U2vZOlmdO0Dl XcRRHN3tzNAfrViH67jR5LhyAkpg2DxnxLL0tZFrywUC54jO8x1wtGwBqS9v48LrhR5e QtxpJlaHfXs3ogViQdF2OX+JaJWKPn/C896+w= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=FiUoa/twLnMmcs88mTMjYJHEJ0oj1jDGS/ns9L/+i10=; b=iBl9OtH7EfL9RjudMsoB51sqPALbK3IukyPGqdLioeHQ9h4EoV9RYuAOLSs3ZNUK4U frRVhP8Ju5poh8CdbKmjUFffB11a24C1oSkkGjLem5gGC/CiNS7rgj8cGXcAgFvxSVrB g5Z4MvKRTwL3qBIbwEaYMFVB5Vl5lzMyBsdE0A/zUlRW1gr5Br4cYWFAkzKSgXMJ+IyH vIIcS3qNrw+ZngJIYWeWH0fIO5OTwcZFY6IUF6cwFHypXZuf6bcImhRkbwqsG4gxlUc3 4JeF/VWO3qC5jIukfOF/cfKY6W5y2a91F9TEuDd1C8qAIv+FEjCVitcTRJ3AiL01Y3MS 6kpA== X-Gm-Message-State: ALoCoQk4n/3XoEZEIS3GwzXoQ2GkK2sru/ojfrFPwPMhxxpd8cNsKOlea1HoYg2eaF346Z0DBfZb/lxSNXa90fXRiQyvrUBQIA== X-Received: by 10.55.72.205 with SMTP id v196mr36523002qka.52.1450284192597; Wed, 16 Dec 2015 08:43:12 -0800 (PST) Received: from [172.16.0.112] (pool-173-73-126-234.washdc.east.verizon.net. [173.73.126.234]) by smtp.gmail.com with ESMTPSA id q71sm2900686qkl.3.2015.12.16.08.43.11 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 16 Dec 2015 08:43:11 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\)) From: Sean Turner In-Reply-To: Date: Wed, 16 Dec 2015 11:43:10 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <961EEF75-1F58-4FD4-A57C-2C871350BBFF@sn3rd.com> References: To: Sandra Murphy X-Mailer: Apple Mail (2.3112) Archived-At: Cc: sidr Subject: Re: [sidr] wg adoption call for draft-tbruijnzeels-sidr-validation-local-cache-02 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Dec 2015 16:43:15 -0000 Just read it (it=E2=80=99s only 9 pages) and support adoption. spt > On Dec 09, 2015, at 18:08, Sandra Murphy wrote: >=20 > As noted in the minutes, the authors of = draft-tbruijnzeels-sidr-validation-local-cache-02 request that the = working group adopt this work as a wg work item. >=20 > A working group adoption poll starts now and will end 14 days from now = on 23 December. >=20 > Please respond on the list to say whether you support adoption of this = work as a working group work item AND whether you will participate in = the discussion. >=20 > Remember that working group consensus to adopt the work needs = responses, not just absence of objection, so speak up. >=20 > --Sandy, speaking as one of the wg co-chairs > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From nobody Wed Dec 16 14:36:12 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 034D91A8A58 for ; Wed, 16 Dec 2015 14:36:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.211 X-Spam-Level: X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lcG6sse_fM0g for ; Wed, 16 Dec 2015 14:36:10 -0800 (PST) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF4731A9006 for ; Wed, 16 Dec 2015 14:36:09 -0800 (PST) Received: from ssh.bbn.com ([192.1.122.15]:44119 helo=COMSEC.fios-router.home) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1a9Kg4-000CT7-Hp; Wed, 16 Dec 2015 17:36:08 -0500 To: Tim Bruijnzeels References: <56709354.6080006@bbn.com> <26C6CEB6-D858-4AC4-BC6E-3B3A8927CE03@ripe.net> From: Stephen Kent Message-ID: <5671E757.7080207@bbn.com> Date: Wed, 16 Dec 2015 17:36:07 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <26C6CEB6-D858-4AC4-BC6E-3B3A8927CE03@ripe.net> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: sidr@ietf.org Subject: Re: [sidr] wg adoption call for draft-tbruijnzeels-sidr-validation-local-cache-02 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Dec 2015 22:36:11 -0000 Tim, Since, as you reminded me, this is Informational, I agree that this doc need not be co-authored as I had suggested. But the intro must emphasize that it just documenting what RIPE has chosen to do, and that it does not claim to be a set of recommended local cache management design notes. Steve From nobody Thu Dec 17 00:57:22 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BB2F1A219C for ; Thu, 17 Dec 2015 00:57:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IyIs5a-yq_6M for ; Thu, 17 Dec 2015 00:57:19 -0800 (PST) Received: from molamola.ripe.net (molamola.ripe.net [IPv6:2001:67c:2e8:11::c100:1371]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 590DC1A2182 for ; Thu, 17 Dec 2015 00:57:19 -0800 (PST) Received: from nene.ripe.net ([193.0.23.10]) by molamola.ripe.net with esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.84) (envelope-from ) id 1a9UN9-0002nC-QV; Thu, 17 Dec 2015 09:57:17 +0100 Received: from sslvpn.ripe.net ([193.0.20.230] helo=vpn-243.ripe.net) by nene.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1a9UN9-0004Hy-Lv; Thu, 17 Dec 2015 09:57:15 +0100 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\)) Content-Type: text/plain; charset=windows-1252 From: Tim Bruijnzeels In-Reply-To: <5671E757.7080207@bbn.com> Date: Thu, 17 Dec 2015 09:57:16 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: References: <56709354.6080006@bbn.com> <26C6CEB6-D858-4AC4-BC6E-3B3A8927CE03@ripe.net> <5671E757.7080207@bbn.com> To: Stephen Kent X-Mailer: Apple Mail (2.2104) X-ACL-Warn: Delaying message X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a0719aac87dd2927f5afb44ea64700aa99e6f Archived-At: Cc: sidr@ietf.org Subject: Re: [sidr] wg adoption call for draft-tbruijnzeels-sidr-validation-local-cache-02 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Dec 2015 08:57:21 -0000 Hi Steve, On 16 Dec 2015, at 23:36, Stephen Kent wrote: >=20 > Tim, >=20 > Since, as you reminded me, this is Informational, I agree that this > doc need not be co-authored as I had suggested. But the intro must > emphasize that it just documenting what RIPE has chosen to do, and > that it does not claim to be a set of recommended local cache = management > design notes. I agree. And I have no objections to a name change of the document = either.. maybe: ripe-ncc-rpki-validation-implementation Tim >=20 > Steve >=20 >=20 From nobody Thu Dec 17 08:27:42 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 967081B2F13 for ; Thu, 17 Dec 2015 08:27:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 33oB4uNZu_JX for ; Thu, 17 Dec 2015 08:27:31 -0800 (PST) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 48BE31B2F5B for ; Thu, 17 Dec 2015 08:27:31 -0800 (PST) Received: from ssh.bbn.com ([192.1.122.15]:48154 helo=COMSEC.fios-router.home) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1a9bOr-0003PZ-K5; Thu, 17 Dec 2015 11:27:30 -0500 From: Stephen Kent To: Tim Bruijnzeels References: <565617E8.4070005@bbn.com> <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> Message-ID: <5672E271.6080201@bbn.com> Date: Thu, 17 Dec 2015 11:27:29 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.4.0 MIME-Version: 1.0 In-Reply-To: <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> Content-Type: multipart/alternative; boundary="------------070601000407020007070403" Archived-At: Cc: sidr Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Dec 2015 16:27:38 -0000 This is a multi-part message in MIME format. --------------070601000407020007070403 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Tim, > ... > I believe the draft is being precise, but in the process has become difficult to parse. Let me attempt once more to explain the proposal in a different way: > > "When doing top-down validation of resource certificates in the RPKI we propose that rather than rejecting a certificate that has resources not held by the parent (but is valid on all other respects), we would accept the certificate but keep note of the actual resources we believe it can be authoritative for. I.e. the intersection of resources on this certificate and the resources accepted for the parent. The RP SHOULD however issue a warning in case certain resources are excluded because of this, so that the responsible CA can fix the situation. That's a reasonable goal, but it does not match what the revised algorithm says. > Please note that for ROAs there is a requirement that all ROA prefixes are included on the EE certificate of the (ROA) signed object CMS. This proposal does not change this. A ROA that has prefixes that were removed for whatever reason higher in the path would still become invalid using this algorithm. We would therefore RECOMMEND that CAs issue 1 ROA for each prefix, and avoid fate sharing. That way only ROAs for prefixes that were removed will be affected." The recommendation you cite belongs in an updated ROA spec. > Essentially that really is all there is to it. I'm afraid it's not that simple. The statement of what you want to accomplish does not match the algorithm described in Section 5, and that is my point, i.e., the revised algorithm is not correct. > If this is easier to parse, and the co-chairs conclude that work should continue, then I am happy to use this line of explanation in a next version of the document. And no, I have no doubt that it will need more detail than above in an I-D - but it's the basic principle that I am trying to convey here. As I noted above, the algorithm description in Section 5 doesn't match what you say you want to accomplish. Below is my take on what a revised validation algorithm should say to implement what you and your co-authors seem to want to accomplish. You'll note that it is substantially different from the text that appears in the current I-D. Steve ------ 7.2.Resource Certification Path Validation The following algorithm is employed to validate CA and EE resources certificates. It is modeled on the path validation algorithm from [RFC5280], but modified to make use of the IP Address Delegation and AS Identifier Delegation Extensions from [RFC3779]. There are two inputs to the validation algorithm: 1.a trust anchor 2.a certificate to be validated The algorithm is initialized with the following new variables: 1.If an IP Address Delegation extension is present in the trust anchor the address set flag is initialized to TRUE and the address resource working set is initialized to the value of this extension. If the extension is absent, the flag is initialized to FALSE and the address resource working set is initialized to NULL. 2.If an AS Identifier Delegation extension is present in the trust anchor, the AS number flag is initialized to TRUE and the AS number resource working set is initialized to the value of this extension. If the extension is absent, the flag is initialized to FALSE and the AS number working set is initialized to NULL. This path validation algorithm verifies, among other things, that a prospective certification path (a sequence of n certificates) satisfies the following conditions: A.for all 'x' in {1, ..., n-1}, the subject of certificate 'x' is the issuer of certificate ('x' + 1); B.certificate '1' is issued by a trust anchor; C.certificate 'n' is the certificate to be validated; and D.for all 'x' in {1, ..., n}, certificate 'x' is valid. Certificate validation requires verifying that all of the following conditions hold, in addition to the certification path validation criteria specified in Section 6 of [RFC5280]. 1.The signature of certificate x is verified using the public key of the issuer’s certificate (x-1), using the signature algorithm specified for that public key (in certificate x-1). 2.The current time lies within the interval defined by the NotBefore and NotAfter values in the Validity field of certificate x. 3.The Version, Issuer, and Subject fields of certificate x satisfy the constraints established in Section 4.1-4.7 of this specification. 4.Certificate x contains all the extensions that MUST be present, as defined in Section 4.8 of this specification. The value(s) for each of these extensions MUST be satisfy the constraints established for each extension in the respective sections. 5.Any extension not identified in Section 4.8 MUST NOT appear in certificate x. 5.Certificate x MUST NOT have been revoked, i.e., it MUST NOT appear on a CRL issued by the CA represented by certificate x-1 6.Compute the address space and the AS number working sets and flags values for certificate x as follows: If the IP Address Delegation extension is present in certificate x, and the address flag is TRUE, then compute the intersection of the resources between this extension and the current value of the address space working set. If the IP Address Delegation extension is present in certificate x, and the address flag is FALSE, the certificate fails validation. If the IP Address Delegation extension is absent in certificate x, set the address set flag to FALSE. If the AS Identifier Delegation extension is present in certificate x, and the AS number flag is TRUE, then compute the intersection of the resources between this extension and the current value of the address space working set. If the AS Identifier Delegation extension is present in certificate x, and the AS number flag is FALSE, the certificate fails validation. If the AS Identifier Delegation extension is absent in certificate x, set the AS number flag to FALSE. If x = n (i.e., this is the certificate being validated) then the IP address space and AS number working sets are treated as the values for the IP Address and AS Identifier Delegation extensions for this certificate, respectively. If an RP is caching the results of validation, these values SHOULD be stored along with the certificate, to facilitate incremental validation based on cached results. Otherwise, return to step 1 and continue path validation. These rules allow a CA certificate to contain resources that are not present in (all of) the certificates along the path from the trust anchor to the CA certificate. (If none of the resources in the CA certificate are present in all certificates along the path, no subordinate certificates could be valid. However, the certificate is not immediately rejected as this may be a transient condition. Not immediately rejected the certificate does not result in a security problem because the associated working resource sets accurately reflect the resources associated with the certificate in question.) The address and/or AS number resources contained in a valid EE certificate being validated MUST always be encompassed by all certificates along the path to the trust anchor (used to verify that EE certificate). Also note that if any CA certificate along the path has no address space resources, then any subordinate certificate MUST NOT contain address space resources. The same constraint applies to AS number resources. --------------070601000407020007070403 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit Tim,
...
I believe the draft is being precise, but in the process has become difficult to parse. Let me attempt once more to explain the proposal in a different way:

"When doing top-down validation of resource certificates in the RPKI we propose that rather than rejecting a certificate that has resources not held by the parent (but is valid on all other respects), we would accept the certificate but keep note of the actual resources we believe it can be authoritative for. I.e. the intersection of resources on this certificate and the resources accepted for the parent. The RP SHOULD however issue a warning in case certain resources are excluded because of this, so that the responsible CA can fix the situation.
That's a reasonable goal, but it does not match what the revised algorithm says.
Please note that for ROAs there is a requirement that all ROA prefixes are included on the EE certificate of the (ROA) signed object CMS. This proposal does not change this. A ROA that has prefixes that were removed for whatever reason higher in the path would still become invalid using this algorithm. We would therefore RECOMMEND that CAs issue 1 ROA for each prefix, and avoid fate sharing. That way only ROAs for prefixes that were removed will be affected."
The recommendation you cite belongs in an updated ROA spec. 
Essentially that really is all there is to it.
I'm afraid it's not that simple. The statement of what you want to accomplish
does not match the algorithm described in Section 5, and that is my point, i.e.,
the revised algorithm is not correct.
If this is easier to parse, and the co-chairs conclude that work should continue, then I am happy to use this line of explanation in a next version of the document. And no, I have no doubt that it will need more detail than above in an I-D - but it's the basic principle that I am trying to convey here.
As I noted above, the algorithm description in Section 5 doesn't match what
you say you want to accomplish. Below is my take on what a revised validation
algorithm should say to implement what you and your co-authors seem to want to accomplish. You'll note that it is substantially  different from the text
that appears in the current I-D.

Steve

------

7.2.  Resource Certification Path Validation

 

The following algorithm is employed to validate CA and EE resources certificates. It is modeled on the path validation algorithm from [RFC5280], but modified to make use of the IP Address Delegation and AS

Identifier Delegation Extensions from [RFC3779].

 

There are two inputs to the validation algorithm:

1.  a trust anchor

2.  a certificate to be validated

 

The algorithm is initialized with the following new variables:

 

1. If an IP Address Delegation extension is present in the trust anchor the address set flag is initialized to TRUE and the address resource working set is initialized to the value of this extension. If the extension is absent, the flag is initialized to FALSE and the address resource working set is initialized to NULL.

 

2. If an AS Identifier Delegation extension is present in the trust anchor, the AS number flag is initialized to TRUE and the AS number resource working set is initialized to the value of this extension. If the extension is absent, the flag is initialized to FALSE and the AS number working set is initialized to NULL.

 

 

This path validation algorithm verifies, among other things, that a

prospective certification path (a sequence of n certificates)

satisfies the following conditions:

 

      A.  for all 'x' in {1, ..., n-1}, the subject of certificate 'x'

          is the issuer of certificate ('x' + 1);

 

      B.  certificate '1' is issued by a trust anchor;

 

      C.  certificate 'n' is the certificate to be validated; and

 

      D.  for all 'x' in {1, ..., n}, certificate 'x' is valid.

 

   Certificate validation requires verifying that all of the following

   conditions hold, in addition to the certification path validation

   criteria specified in Section 6 of [RFC5280].

 

 

1.      The signature of certificate x is verified using the

    public key of the issuer’s certificate (x-1), using the

    signature algorithm specified for that public key (in

    certificate x-1).

 

2.  The current time lies within the interval defined by the

NotBefore and NotAfter values in the Validity field of

certificate x.

 

3.  The Version, Issuer, and Subject fields of certificate x

satisfy the constraints established in Section 4.1-4.7

of this specification.

 

4.  Certificate x contains all the extensions that MUST be

present, as defined in Section 4.8 of this specification.

The value(s) for each of these extensions MUST be satisfy

the constraints established for each extension in the

respective sections.

 

      5. Any extension not identified in Section 4.8 MUST NOT

         appear in certificate x.

 

5.  Certificate x MUST NOT have been revoked, i.e., it

MUST NOT appear on a CRL issued by the CA represented by certificate x-1

 

6.  Compute the address space and the AS number working sets
and flags values for certificate x as follows:

 

If the IP Address Delegation extension is present

in certificate x, and the address flag is TRUE, then

compute the intersection of the resources between this

extension and the current value of the address

space working set.

 

If the IP Address Delegation extension is present

in certificate x, and the address flag is FALSE,

the certificate fails validation.

 

If the IP Address Delegation extension is absent

in certificate x, set the address set flag to FALSE.

 

If the AS Identifier Delegation extension is present

in certificate x, and the AS number flag is TRUE, then

compute the intersection of the resources between this

extension and the current value of the address

space working set.

 

If the AS Identifier Delegation extension is present

in certificate x, and the AS number flag is FALSE,

the certificate fails validation.

 

If the AS Identifier Delegation extension is absent

in certificate x, set the AS number flag to FALSE.

 

If x = n (i.e., this is the certificate being validated)

then the IP address space and AS number working sets are

treated as the values for the IP Address and AS Identifier Delegation extensions for this certificate, respectively.

If an RP is caching the results of validation, these values

SHOULD be stored along with the certificate, to facilitate

incremental validation based on cached results.

 

Otherwise, return to step 1 and continue path validation.


 

These rules allow a CA certificate to contain resources

that are not present in (all of) the certificates along

the path from the trust anchor to the CA certificate.

(If none of the resources in the CA certificate are present

in all certificates along the path, no subordinate

certificates could be valid. However, the certificate is not immediately rejected as this may be a transient condition.

Not immediately rejected the certificate does not result in a security problem because the associated working resource sets accurately reflect the resources associated with the

certificate in question.)

 

The  address and/or AS number resources contained in a

valid EE certificate being validated MUST always be

encompassed by all certificates along the path to the

trust anchor (used to verify that EE certificate). Also

note that if any CA certificate along the path has no

address space resources, then any subordinate certificate

MUST NOT contain address space resources. The same constraint applies to AS number resources.

 


--------------070601000407020007070403-- From nobody Fri Dec 18 01:04:49 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7CB21B34A1 for ; Fri, 18 Dec 2015 01:04:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k4ugZVCUTEYp for ; Fri, 18 Dec 2015 01:04:47 -0800 (PST) Received: from molamola.ripe.net (molamola.ripe.net [IPv6:2001:67c:2e8:11::c100:1371]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E01D1B34A0 for ; Fri, 18 Dec 2015 01:04:45 -0800 (PST) Received: from titi.ripe.net ([193.0.23.11]) by molamola.ripe.net with esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.84) (envelope-from ) id 1a9qxr-000102-6P; Fri, 18 Dec 2015 10:04:41 +0100 Received: from sslvpn.ripe.net ([193.0.20.230] helo=vpn-41.ripe.net) by titi.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1a9qxq-00011j-Ux; Fri, 18 Dec 2015 10:04:39 +0100 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\)) Content-Type: text/plain; charset=utf-8 From: Tim Bruijnzeels In-Reply-To: <5672E271.6080201@bbn.com> Date: Fri, 18 Dec 2015 10:04:39 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: <047E7516-C195-448D-B690-355C7993D58B@ripe.net> References: <565617E8.4070005@bbn.com> <8FB9C3A7-0799-4CF7-80A5-7669070B3C91@ripe.net> <5672E271.6080201@bbn.com> To: Stephen Kent X-Mailer: Apple Mail (2.2104) X-ACL-Warn: Delaying message X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a0719a78afdaa2b51eeafa46081b43a415714 Archived-At: Cc: sidr Subject: Re: [sidr] Validation Reconsidered (again/again) question X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Dec 2015 09:04:49 -0000 Hi Steve, Without going into every detail. I understand this is not what the current text says. I provided an = alternative description to illustrate how I would propose to re-write = text. The current text takes a bottom-up view of the process w.r.t. = verifying the presence of resources looking back up the path for a given = certificate or object. I believe things are much more clear taking a = top-down view. I hope to find time over the next weeks to do this work and would = welcome your feedback on new text when it is done. Tim > On 17 Dec 2015, at 17:27, Stephen Kent wrote: >=20 > Tim, >> ... >> I believe the draft is being precise, but in the process has become = difficult to parse. Let me attempt once more to explain the proposal in = a different way: >>=20 >> "When doing top-down validation of resource certificates in the RPKI = we propose that rather than rejecting a certificate that has resources = not held by the parent (but is valid on all other respects), we would = accept the certificate but keep note of the actual resources we believe = it can be authoritative for. I.e. the intersection of resources on this = certificate and the resources accepted for the parent. The RP SHOULD = however issue a warning in case certain resources are excluded because = of this, so that the responsible CA can fix the situation. >>=20 > That's a reasonable goal, but it does not match what the revised = algorithm says. >> Please note that for ROAs there is a requirement that all ROA = prefixes are included on the EE certificate of the (ROA) signed object = CMS. This proposal does not change this. A ROA that has prefixes that = were removed for whatever reason higher in the path would still become = invalid using this algorithm. We would therefore RECOMMEND that CAs = issue 1 ROA for each prefix, and avoid fate sharing. That way only ROAs = for prefixes that were removed will be affected." > The recommendation you cite belongs in an updated ROA spec.=20 >> Essentially that really is all there is to it.=20 > I'm afraid it's not that simple. The statement of what you want to = accomplish=20 > does not match the algorithm described in Section 5, and that is my = point, i.e., > the revised algorithm is not correct. >> If this is easier to parse, and the co-chairs conclude that work = should continue, then I am happy to use this line of explanation in a = next version of the document. And no, I have no doubt that it will need = more detail than above in an I-D - but it's the basic principle that I = am trying to convey here. >>=20 > As I noted above, the algorithm description in Section 5 doesn't match = what > you say you want to accomplish. Below is my take on what a revised = validation=20 > algorithm should say to implement what you and your co-authors seem to = want to accomplish. You'll note that it is substantially different from = the text > that appears in the current I-D. >=20 > Steve >=20 > ------ >=20 > 7.2. Resource Certification Path Validation > =20 > The following algorithm is employed to validate CA and EE resources = certificates. It is modeled on the path validation algorithm from = [RFC5280], but modified to make use of the IP Address Delegation and AS > Identifier Delegation Extensions from [RFC3779].=20 > =20 > There are two inputs to the validation algorithm: > 1. a trust anchor=20 > 2. a certificate to be validated > =20 > The algorithm is initialized with the following new variables: > =20 > 1. If an IP Address Delegation extension is present in the trust = anchor the address set flag is initialized to TRUE and the address = resource working set is initialized to the value of this extension. If = the extension is absent, the flag is initialized to FALSE and the = address resource working set is initialized to NULL. > =20 > 2. If an AS Identifier Delegation extension is present in the trust = anchor, the AS number flag is initialized to TRUE and the AS number = resource working set is initialized to the value of this extension. If = the extension is absent, the flag is initialized to FALSE and the AS = number working set is initialized to NULL. > =20 > =20 > This path validation algorithm verifies, among other things, that a > prospective certification path (a sequence of n certificates) > satisfies the following conditions: > =20 > A. for all 'x' in {1, ..., n-1}, the subject of certificate 'x' > is the issuer of certificate ('x' + 1); > =20 > B. certificate '1' is issued by a trust anchor; > =20 > C. certificate 'n' is the certificate to be validated; and > =20 > D. for all 'x' in {1, ..., n}, certificate 'x' is valid. > =20 > Certificate validation requires verifying that all of the following > conditions hold, in addition to the certification path validation > criteria specified in Section 6 of [RFC5280]. > =20 > =20 > 1. The signature of certificate x is verified using the=20 > public key of the issuer=E2=80=99s certificate (x-1), using the=20 > signature algorithm specified for that public key (in=20 > certificate x-1). > =20 > 2. The current time lies within the interval defined by the=20 > NotBefore and NotAfter values in the Validity field of=20 > certificate x. > =20 > 3. The Version, Issuer, and Subject fields of certificate x=20 > satisfy the constraints established in Section 4.1-4.7=20 > of this specification. > =20 > 4. Certificate x contains all the extensions that MUST be=20 > present, as defined in Section 4.8 of this specification.=20 > The value(s) for each of these extensions MUST be satisfy > the constraints established for each extension in the > respective sections. > =20 > 5. Any extension not identified in Section 4.8 MUST NOT > appear in certificate x. > =20 > 5. Certificate x MUST NOT have been revoked, i.e., it=20 > MUST NOT appear on a CRL issued by the CA represented by certificate = x-1 > =20 > 6. Compute the address space and the AS number working sets > and flags values for certificate x as follows: > =20 > If the IP Address Delegation extension is present=20 > in certificate x, and the address flag is TRUE, then > compute the intersection of the resources between this=20 > extension and the current value of the address=20 > space working set.=20 > =20 > If the IP Address Delegation extension is present=20 > in certificate x, and the address flag is FALSE, > the certificate fails validation.=20 > =20 > If the IP Address Delegation extension is absent=20 > in certificate x, set the address set flag to FALSE. > =20 > If the AS Identifier Delegation extension is present=20 > in certificate x, and the AS number flag is TRUE, then > compute the intersection of the resources between this=20 > extension and the current value of the address=20 > space working set.=20 > =20 > If the AS Identifier Delegation extension is present=20 > in certificate x, and the AS number flag is FALSE, > the certificate fails validation.=20 > =20 > If the AS Identifier Delegation extension is absent=20 > in certificate x, set the AS number flag to FALSE. > =20 > If x =3D n (i.e., this is the certificate being validated) > then the IP address space and AS number working sets are=20 > treated as the values for the IP Address and AS Identifier Delegation = extensions for this certificate, respectively.=20 > If an RP is caching the results of validation, these values > SHOULD be stored along with the certificate, to facilitate > incremental validation based on cached results. > =20 > Otherwise, return to step 1 and continue path validation. >=20 > =20 > These rules allow a CA certificate to contain resources=20 > that are not present in (all of) the certificates along=20 > the path from the trust anchor to the CA certificate.=20 > (If none of the resources in the CA certificate are present=20 > in all certificates along the path, no subordinate=20 > certificates could be valid. However, the certificate is not = immediately rejected as this may be a transient condition.=20 > Not immediately rejected the certificate does not result in a security = problem because the associated working resource sets accurately reflect = the resources associated with the=20 > certificate in question.) > =20 > The address and/or AS number resources contained in a=20 > valid EE certificate being validated MUST always be=20 > encompassed by all certificates along the path to the=20 > trust anchor (used to verify that EE certificate). Also=20 > note that if any CA certificate along the path has no=20 > address space resources, then any subordinate certificate=20 > MUST NOT contain address space resources. The same constraint applies = to AS number resources.=20 > =20 >=20 >=20 From nobody Mon Dec 21 22:46:46 2015 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DA791A6EF2 for ; Mon, 21 Dec 2015 22:46:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.702 X-Spam-Level: X-Spam-Status: No, score=-0.702 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i2Sbgpud83Mc for ; Mon, 21 Dec 2015 22:46:43 -0800 (PST) Received: from mail.zdns.cn (smtp.knet.cn [202.173.10.15]) by ietfa.amsl.com (Postfix) with SMTP id 1F74E1A6EF0 for ; Mon, 21 Dec 2015 22:46:42 -0800 (PST) X-TM-DID: 7ee05c0d6507dccb0cc4b4cd79dedbcc From: Declan Ma Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Message-Id: <694F7F3C-8AE0-4DCA-AEB0-A4427E426532@zdns.cn> Date: Tue, 22 Dec 2015 14:46:34 +0800 To: sidr Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\)) X-Mailer: Apple Mail (2.3112) Archived-At: Subject: [sidr] draft-kent-sidr-adverse-actions adoption X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Dec 2015 06:46:45 -0000 Hi all, According to the discussions on Adverse Actions draft at IETF Yokohama = meeting and the feedback from the WG mailing list, Steve and I have = removed the text that caused folks concerns relating to mitigation = solutions. I think the updated version of this draft = (https://tools.ietf.org/html/draft-kent-sidr-adverse-actions-02) is = ready for WG adoption.=20 Chairs, please consider this a formal request to put out an adoption = call.=20 Di, ZDNS