Compare commits
No commits in common. 'c9' and 'c10-beta' have entirely different histories.
@ -1,2 +1,2 @@
|
||||
SOURCES/nginx-1.20.1.tar.gz
|
||||
SOURCES/nginx-1.26.1.tar.gz
|
||||
SOURCES/nginx-logo.png
|
||||
|
||||
@ -1,2 +1,2 @@
|
||||
6b4ab4eff3c617e133819f43fdfc14708e593a79 SOURCES/nginx-1.20.1.tar.gz
|
||||
a73998570100134004d665e81783b2a2ff808bcd SOURCES/nginx-1.26.1.tar.gz
|
||||
e28dd656984cc2894d8124c5278789c656f6a9cb SOURCES/nginx-logo.png
|
||||
|
||||
@ -0,0 +1,749 @@
|
||||
From 679397c62265a5ee93953d0913dc834b163a5aec Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
|
||||
Date: Wed, 22 May 2024 22:23:08 +0200
|
||||
Subject: [PATCH 3/3] Add SSL passphrase dialog
|
||||
|
||||
---
|
||||
contrib/vim/syntax/nginx.vim | 1 +
|
||||
src/event/ngx_event_openssl.c | 126 +++++++++++++++++++++--
|
||||
src/event/ngx_event_openssl.h | 14 ++-
|
||||
src/http/modules/ngx_http_grpc_module.c | 2 +-
|
||||
src/http/modules/ngx_http_proxy_module.c | 2 +-
|
||||
src/http/modules/ngx_http_ssl_module.c | 70 ++++++++++++-
|
||||
src/http/modules/ngx_http_ssl_module.h | 2 +
|
||||
src/http/modules/ngx_http_uwsgi_module.c | 2 +-
|
||||
src/mail/ngx_mail_ssl_module.c | 66 +++++++++++-
|
||||
src/mail/ngx_mail_ssl_module.h | 2 +
|
||||
src/stream/ngx_stream_proxy_module.c | 2 +-
|
||||
src/stream/ngx_stream_ssl_module.c | 61 ++++++++++-
|
||||
src/stream/ngx_stream_ssl_module.h | 2 +
|
||||
13 files changed, 335 insertions(+), 17 deletions(-)
|
||||
|
||||
diff --git a/contrib/vim/syntax/nginx.vim b/contrib/vim/syntax/nginx.vim
|
||||
index 29eef7a..e7227eb 100644
|
||||
--- a/contrib/vim/syntax/nginx.vim
|
||||
+++ b/contrib/vim/syntax/nginx.vim
|
||||
@@ -593,6 +593,7 @@ syn keyword ngxDirective contained ssl_ocsp
|
||||
syn keyword ngxDirective contained ssl_ocsp_cache
|
||||
syn keyword ngxDirective contained ssl_ocsp_responder
|
||||
syn keyword ngxDirective contained ssl_password_file
|
||||
+syn keyword ngxDirective contained ssl_pass_phrase_dialog
|
||||
syn keyword ngxDirective contained ssl_prefer_server_ciphers
|
||||
syn keyword ngxDirective contained ssl_preread
|
||||
syn keyword ngxDirective contained ssl_protocols
|
||||
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
|
||||
index 89f277f..6f7f2a2 100644
|
||||
--- a/src/event/ngx_event_openssl.c
|
||||
+++ b/src/event/ngx_event_openssl.c
|
||||
@@ -11,6 +11,7 @@
|
||||
|
||||
|
||||
#define NGX_SSL_PASSWORD_BUFFER_SIZE 4096
|
||||
+#define NGX_PASS_PHRASE_ARG_MAX_LEN 255
|
||||
|
||||
|
||||
typedef struct {
|
||||
@@ -21,7 +22,7 @@ typedef struct {
|
||||
static X509 *ngx_ssl_load_certificate(ngx_pool_t *pool, char **err,
|
||||
ngx_str_t *cert, STACK_OF(X509) **chain);
|
||||
static EVP_PKEY *ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err,
|
||||
- ngx_str_t *key, ngx_array_t *passwords);
|
||||
+ ngx_str_t *key, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg);
|
||||
static int ngx_ssl_password_callback(char *buf, int size, int rwflag,
|
||||
void *userdata);
|
||||
static int ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store);
|
||||
@@ -85,6 +86,12 @@ static time_t ngx_ssl_parse_time(
|
||||
#endif
|
||||
ASN1_TIME *asn1time, ngx_log_t *log);
|
||||
|
||||
+static int ngx_ssl_read_pstream(const char *cmd, char *buf,
|
||||
+ ngx_int_t bufsize);
|
||||
+
|
||||
+static int ngx_ssl_pass_phrase_callback(char *buf, int bufsize,
|
||||
+ int rwflag, void *u);
|
||||
+
|
||||
static void *ngx_openssl_create_conf(ngx_cycle_t *cycle);
|
||||
static char *ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf);
|
||||
static void ngx_openssl_exit(ngx_cycle_t *cycle);
|
||||
@@ -432,7 +439,7 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
|
||||
|
||||
ngx_int_t
|
||||
ngx_ssl_certificates(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_array_t *certs,
|
||||
- ngx_array_t *keys, ngx_array_t *passwords)
|
||||
+ ngx_array_t *keys, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg)
|
||||
{
|
||||
ngx_str_t *cert, *key;
|
||||
ngx_uint_t i;
|
||||
@@ -442,7 +449,7 @@ ngx_ssl_certificates(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_array_t *certs,
|
||||
|
||||
for (i = 0; i < certs->nelts; i++) {
|
||||
|
||||
- if (ngx_ssl_certificate(cf, ssl, &cert[i], &key[i], passwords)
|
||||
+ if (ngx_ssl_certificate(cf, ssl, &cert[i], &key[i], passwords, dlg)
|
||||
!= NGX_OK)
|
||||
{
|
||||
return NGX_ERROR;
|
||||
@@ -455,12 +462,13 @@ ngx_ssl_certificates(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_array_t *certs,
|
||||
|
||||
ngx_int_t
|
||||
ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
|
||||
- ngx_str_t *key, ngx_array_t *passwords)
|
||||
+ ngx_str_t *key, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg)
|
||||
{
|
||||
char *err;
|
||||
X509 *x509;
|
||||
EVP_PKEY *pkey;
|
||||
STACK_OF(X509) *chain;
|
||||
+ EVP_PKEY *pubkey;
|
||||
|
||||
x509 = ngx_ssl_load_certificate(cf->pool, &err, cert, &chain);
|
||||
if (x509 == NULL) {
|
||||
@@ -550,8 +558,23 @@ ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
|
||||
}
|
||||
#endif
|
||||
|
||||
- pkey = ngx_ssl_load_certificate_key(cf->pool, &err, key, passwords);
|
||||
- if (pkey == NULL) {
|
||||
+ pubkey = X509_get_pubkey(x509);
|
||||
+ if (!pubkey) {
|
||||
+ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
|
||||
+ "X509_get_pubkey() failed");
|
||||
+ return NGX_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ if (dlg) {
|
||||
+ dlg->cryptosystem = EVP_PKEY_get_base_id(pubkey);
|
||||
+ }
|
||||
+
|
||||
+ EVP_PKEY_free(pubkey);
|
||||
+
|
||||
+ pkey = ngx_ssl_load_certificate_key(cf->pool, &err, key, passwords, dlg);
|
||||
+ if (ngx_test_config) {
|
||||
+ return NGX_OK;
|
||||
+ } else if (pkey == NULL) {
|
||||
if (err != NULL) {
|
||||
ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
|
||||
"cannot load certificate key \"%s\": %s",
|
||||
@@ -621,7 +644,7 @@ ngx_ssl_connection_certificate(ngx_connection_t *c, ngx_pool_t *pool,
|
||||
|
||||
#endif
|
||||
|
||||
- pkey = ngx_ssl_load_certificate_key(pool, &err, key, passwords);
|
||||
+ pkey = ngx_ssl_load_certificate_key(pool, &err, key, passwords, NULL);
|
||||
if (pkey == NULL) {
|
||||
if (err != NULL) {
|
||||
ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
|
||||
@@ -734,10 +757,82 @@ ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, ngx_str_t *cert,
|
||||
return x509;
|
||||
}
|
||||
|
||||
+static int
|
||||
+ngx_ssl_read_pstream(const char *cmd, char *buf, ngx_int_t bufsize)
|
||||
+{
|
||||
+ FILE *fp;
|
||||
+ ngx_int_t i;
|
||||
+ char c;
|
||||
+
|
||||
+ fp = popen(cmd, "r");
|
||||
+ if (fp == NULL) {
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
+ for (i = 0; (c = fgetc(fp)) != EOF &&
|
||||
+ (i < bufsize - 1); i++) {
|
||||
+
|
||||
+ if (c == '\n' || c == '\r'){
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
+ buf[i] = c;
|
||||
+ }
|
||||
+ buf[i] = '\0';
|
||||
+
|
||||
+ pclose(fp);
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+static int
|
||||
+ngx_ssl_pass_phrase_callback(char *buf, int bufsize, int rwflag, void *u)
|
||||
+{
|
||||
+ u_char cmd[NGX_PASS_PHRASE_ARG_MAX_LEN + 1] = {0};
|
||||
+ u_char *cmd_end;
|
||||
+ ngx_ssl_ppdialog_conf_t *dlg = (ngx_ssl_ppdialog_conf_t *)u;
|
||||
+ ngx_str_t *pass_phrase_dialog = dlg->data;
|
||||
+ char cryptosystem[4] = {0};
|
||||
+ int ret;
|
||||
+
|
||||
+ /* remove exec: str from pass_phrase_dialog */
|
||||
+ pass_phrase_dialog->data = pass_phrase_dialog->data + 5;
|
||||
+ pass_phrase_dialog->len = pass_phrase_dialog->len - 5;
|
||||
+
|
||||
+ switch (dlg->cryptosystem){
|
||||
+ case EVP_PKEY_RSA:
|
||||
+ strncpy(cryptosystem, "RSA", 4);
|
||||
+ break;
|
||||
+ case EVP_PKEY_DSA:
|
||||
+ strncpy(cryptosystem, "DSA", 4);
|
||||
+ break;
|
||||
+ case EVP_PKEY_EC:
|
||||
+ strncpy(cryptosystem, "EC", 3);
|
||||
+ break;
|
||||
+ case EVP_PKEY_DH:
|
||||
+ strncpy(cryptosystem, "DH", 3);
|
||||
+ break;
|
||||
+ default:
|
||||
+ strncpy(cryptosystem, "UNK", 4);
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
+ cmd_end = ngx_snprintf(cmd, NGX_PASS_PHRASE_ARG_MAX_LEN, "%V %V %s",
|
||||
+ pass_phrase_dialog, dlg->server, cryptosystem);
|
||||
+ *cmd_end = '\0';
|
||||
+
|
||||
+ ngx_log_stderr(0, "Executing external script: %s\n", cmd);
|
||||
+
|
||||
+ if ((ret = ngx_ssl_read_pstream((char *)cmd, buf, bufsize)) != 0){
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
+ return strlen(buf);
|
||||
+}
|
||||
|
||||
static EVP_PKEY *
|
||||
ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err,
|
||||
- ngx_str_t *key, ngx_array_t *passwords)
|
||||
+ ngx_str_t *key, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg)
|
||||
{
|
||||
BIO *bio;
|
||||
EVP_PKEY *pkey;
|
||||
@@ -825,6 +920,21 @@ ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err,
|
||||
tries = 1;
|
||||
pwd = NULL;
|
||||
cb = NULL;
|
||||
+
|
||||
+ /** directive format: ssl_pass_phrase_dialog builtin|exec:filepath */
|
||||
+ if (dlg && ngx_strncasecmp(dlg->data->data, (u_char *)"exec:", 5) == 0){
|
||||
+ pwd = (void *)dlg;
|
||||
+ cb = ngx_ssl_pass_phrase_callback;
|
||||
+ } else {
|
||||
+ pwd = NULL;
|
||||
+ cb = NULL;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ /* skip decrypting private keys in config test phase to avoid
|
||||
+ asking for pass phase twice */
|
||||
+ if (ngx_test_config){
|
||||
+ return NULL;
|
||||
}
|
||||
|
||||
for ( ;; ) {
|
||||
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
|
||||
index ebb2c35..761f48d 100644
|
||||
--- a/src/event/ngx_event_openssl.h
|
||||
+++ b/src/event/ngx_event_openssl.h
|
||||
@@ -82,9 +82,19 @@
|
||||
#define ERR_peek_error_data(d, f) ERR_peek_error_line_data(NULL, NULL, d, f)
|
||||
#endif
|
||||
|
||||
+#define NGX_SSL_PASS_PHRASE_ARG_MAX_LEN 255
|
||||
+#define NGX_SSL_PASS_PHRASE_DEFAULT_VAL "builtin"
|
||||
+#define NGX_SSL_SERVER_NULL "undefined"
|
||||
|
||||
typedef struct ngx_ssl_ocsp_s ngx_ssl_ocsp_t;
|
||||
|
||||
+typedef struct ngx_ssl_ppdialog_conf_s ngx_ssl_ppdialog_conf_t;
|
||||
+
|
||||
+struct ngx_ssl_ppdialog_conf_s {
|
||||
+ ngx_str_t *data;
|
||||
+ ngx_str_t *server;
|
||||
+ ngx_int_t cryptosystem;
|
||||
+};
|
||||
|
||||
struct ngx_ssl_s {
|
||||
SSL_CTX *ctx;
|
||||
@@ -192,9 +202,9 @@ ngx_int_t ngx_ssl_init(ngx_log_t *log);
|
||||
ngx_int_t ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data);
|
||||
|
||||
ngx_int_t ngx_ssl_certificates(ngx_conf_t *cf, ngx_ssl_t *ssl,
|
||||
- ngx_array_t *certs, ngx_array_t *keys, ngx_array_t *passwords);
|
||||
+ ngx_array_t *certs, ngx_array_t *keys, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg);
|
||||
ngx_int_t ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
|
||||
- ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
|
||||
+ ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords, ngx_ssl_ppdialog_conf_t *dlg);
|
||||
ngx_int_t ngx_ssl_connection_certificate(ngx_connection_t *c, ngx_pool_t *pool,
|
||||
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
|
||||
|
||||
diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c
|
||||
index dfe49c5..904263d 100644
|
||||
--- a/src/http/modules/ngx_http_grpc_module.c
|
||||
+++ b/src/http/modules/ngx_http_grpc_module.c
|
||||
@@ -4983,7 +4983,7 @@ ngx_http_grpc_set_ssl(ngx_conf_t *cf, ngx_http_grpc_loc_conf_t *glcf)
|
||||
if (ngx_ssl_certificate(cf, glcf->upstream.ssl,
|
||||
&glcf->upstream.ssl_certificate->value,
|
||||
&glcf->upstream.ssl_certificate_key->value,
|
||||
- glcf->upstream.ssl_passwords)
|
||||
+ glcf->upstream.ssl_passwords, NULL)
|
||||
!= NGX_OK)
|
||||
{
|
||||
return NGX_ERROR;
|
||||
diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c
|
||||
index 9cc202c..2c938d7 100644
|
||||
--- a/src/http/modules/ngx_http_proxy_module.c
|
||||
+++ b/src/http/modules/ngx_http_proxy_module.c
|
||||
@@ -5032,7 +5032,7 @@ ngx_http_proxy_set_ssl(ngx_conf_t *cf, ngx_http_proxy_loc_conf_t *plcf)
|
||||
if (ngx_ssl_certificate(cf, plcf->upstream.ssl,
|
||||
&plcf->upstream.ssl_certificate->value,
|
||||
&plcf->upstream.ssl_certificate_key->value,
|
||||
- plcf->upstream.ssl_passwords)
|
||||
+ plcf->upstream.ssl_passwords, NULL)
|
||||
!= NGX_OK)
|
||||
{
|
||||
return NGX_ERROR;
|
||||
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
|
||||
index 1c92d9f..35132b9 100644
|
||||
--- a/src/http/modules/ngx_http_ssl_module.c
|
||||
+++ b/src/http/modules/ngx_http_ssl_module.c
|
||||
@@ -21,6 +21,8 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c,
|
||||
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
|
||||
#define NGX_DEFAULT_ECDH_CURVE "auto"
|
||||
|
||||
+static ngx_str_t ngx_ssl_server_null = ngx_string(NGX_SSL_SERVER_NULL);
|
||||
+
|
||||
#define NGX_HTTP_ALPN_PROTOS "\x08http/1.1\x08http/1.0\x08http/0.9"
|
||||
|
||||
|
||||
@@ -59,6 +61,9 @@ static ngx_int_t ngx_http_ssl_quic_compat_init(ngx_conf_t *cf,
|
||||
ngx_http_conf_addr_t *addr);
|
||||
#endif
|
||||
|
||||
+static char *ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||
+ void *conf);
|
||||
+
|
||||
|
||||
static ngx_conf_bitmask_t ngx_http_ssl_protocols[] = {
|
||||
{ ngx_string("SSLv2"), NGX_SSL_SSLv2 },
|
||||
@@ -290,6 +295,13 @@ static ngx_command_t ngx_http_ssl_commands[] = {
|
||||
offsetof(ngx_http_ssl_srv_conf_t, reject_handshake),
|
||||
NULL },
|
||||
|
||||
+ { ngx_string("ssl_pass_phrase_dialog"),
|
||||
+ NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
|
||||
+ ngx_conf_set_pass_phrase_dialog,
|
||||
+ NGX_HTTP_SRV_CONF_OFFSET,
|
||||
+ offsetof(ngx_http_ssl_srv_conf_t, pass_phrase_dialog),
|
||||
+ NULL },
|
||||
+
|
||||
ngx_null_command
|
||||
};
|
||||
|
||||
@@ -609,6 +621,7 @@ ngx_http_ssl_create_srv_conf(ngx_conf_t *cf)
|
||||
* sscf->ocsp_responder = { 0, NULL };
|
||||
* sscf->stapling_file = { 0, NULL };
|
||||
* sscf->stapling_responder = { 0, NULL };
|
||||
+ * sscf->pass_phrase_dialog = NULL;
|
||||
*/
|
||||
|
||||
sscf->prefer_server_ciphers = NGX_CONF_UNSET;
|
||||
@@ -639,6 +652,8 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
{
|
||||
ngx_http_ssl_srv_conf_t *prev = parent;
|
||||
ngx_http_ssl_srv_conf_t *conf = child;
|
||||
+ ngx_http_core_srv_conf_t *cscf;
|
||||
+ ngx_ssl_ppdialog_conf_t dlg;
|
||||
|
||||
ngx_pool_cleanup_t *cln;
|
||||
|
||||
@@ -694,6 +709,9 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
ngx_conf_merge_str_value(conf->stapling_responder,
|
||||
prev->stapling_responder, "");
|
||||
|
||||
+ ngx_conf_merge_str_value(conf->pass_phrase_dialog,
|
||||
+ prev->pass_phrase_dialog, NGX_SSL_PASS_PHRASE_DEFAULT_VAL);
|
||||
+
|
||||
conf->ssl.log = cf->log;
|
||||
|
||||
if (conf->certificates) {
|
||||
@@ -726,6 +744,30 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
cln->handler = ngx_ssl_cleanup_ctx;
|
||||
cln->data = &conf->ssl;
|
||||
|
||||
+ /** directive format: ssl_pass_phrase_dialog builtin|exec:filepath */
|
||||
+ if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)"exec:", 5) == 0){
|
||||
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||
+ "ssl_pass_phrase_dialog config directive SET: %s ", conf->pass_phrase_dialog.data);
|
||||
+ } else if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)NGX_SSL_PASS_PHRASE_DEFAULT_VAL,
|
||||
+ sizeof(NGX_SSL_PASS_PHRASE_DEFAULT_VAL)) != 0){
|
||||
+
|
||||
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||
+ "ssl_pass_phrase_dialog config directive accepts only the following "
|
||||
+ "values: %s | exec:filepath", NGX_SSL_PASS_PHRASE_DEFAULT_VAL);
|
||||
+
|
||||
+ return NGX_CONF_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ cscf = ngx_http_conf_get_module_srv_conf(cf, ngx_http_core_module);
|
||||
+
|
||||
+ dlg.data = &conf->pass_phrase_dialog;
|
||||
+ if (cscf->server_name.len != 0) {
|
||||
+ dlg.server = &cscf->server_name;
|
||||
+ } else {
|
||||
+ dlg.server = &ngx_ssl_server_null;
|
||||
+ }
|
||||
+
|
||||
+
|
||||
#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
|
||||
|
||||
if (SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx,
|
||||
@@ -776,7 +818,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
/* configure certificates */
|
||||
|
||||
if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates,
|
||||
- conf->certificate_keys, conf->passwords)
|
||||
+ conf->certificate_keys, conf->passwords, &dlg)
|
||||
!= NGX_OK)
|
||||
{
|
||||
return NGX_CONF_ERROR;
|
||||
@@ -1329,6 +1371,32 @@ ngx_http_ssl_init(ngx_conf_t *cf)
|
||||
return NGX_OK;
|
||||
}
|
||||
|
||||
+static char *
|
||||
+ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
|
||||
+{
|
||||
+ ngx_http_ssl_srv_conf_t *sscf = conf;
|
||||
+ ngx_str_t *value;
|
||||
+
|
||||
+ if (sscf->pass_phrase_dialog.data){
|
||||
+ return "is duplicate";
|
||||
+ }
|
||||
+
|
||||
+ value = cf->args->elts;
|
||||
+
|
||||
+ sscf->pass_phrase_dialog = value[1];
|
||||
+
|
||||
+ if (sscf->pass_phrase_dialog.len == 0) {
|
||||
+ return NGX_CONF_OK;
|
||||
+ } else if (sscf->pass_phrase_dialog.len > NGX_SSL_PASS_PHRASE_ARG_MAX_LEN) {
|
||||
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||
+ "ssl_pass_phrase_dialog argument length exceeded maximum possible length: %d",
|
||||
+ NGX_SSL_PASS_PHRASE_ARG_MAX_LEN);
|
||||
+
|
||||
+ return NGX_CONF_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ return NGX_CONF_OK;
|
||||
+}
|
||||
|
||||
#if (NGX_QUIC_OPENSSL_COMPAT)
|
||||
|
||||
diff --git a/src/http/modules/ngx_http_ssl_module.h b/src/http/modules/ngx_http_ssl_module.h
|
||||
index c69c8ff..79f1506 100644
|
||||
--- a/src/http/modules/ngx_http_ssl_module.h
|
||||
+++ b/src/http/modules/ngx_http_ssl_module.h
|
||||
@@ -62,6 +62,8 @@ typedef struct {
|
||||
ngx_flag_t stapling_verify;
|
||||
ngx_str_t stapling_file;
|
||||
ngx_str_t stapling_responder;
|
||||
+
|
||||
+ ngx_str_t pass_phrase_dialog;
|
||||
} ngx_http_ssl_srv_conf_t;
|
||||
|
||||
|
||||
diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c
|
||||
index c1731ff..ab9d98a 100644
|
||||
--- a/src/http/modules/ngx_http_uwsgi_module.c
|
||||
+++ b/src/http/modules/ngx_http_uwsgi_module.c
|
||||
@@ -2567,7 +2567,7 @@ ngx_http_uwsgi_set_ssl(ngx_conf_t *cf, ngx_http_uwsgi_loc_conf_t *uwcf)
|
||||
if (ngx_ssl_certificate(cf, uwcf->upstream.ssl,
|
||||
&uwcf->upstream.ssl_certificate->value,
|
||||
&uwcf->upstream.ssl_certificate_key->value,
|
||||
- uwcf->upstream.ssl_passwords)
|
||||
+ uwcf->upstream.ssl_passwords, NULL)
|
||||
!= NGX_OK)
|
||||
{
|
||||
return NGX_ERROR;
|
||||
diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c
|
||||
index aebb4cc..5d95f44 100644
|
||||
--- a/src/mail/ngx_mail_ssl_module.c
|
||||
+++ b/src/mail/ngx_mail_ssl_module.c
|
||||
@@ -13,6 +13,7 @@
|
||||
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
|
||||
#define NGX_DEFAULT_ECDH_CURVE "auto"
|
||||
|
||||
+static ngx_str_t ngx_ssl_server_null = ngx_string(NGX_SSL_SERVER_NULL);
|
||||
|
||||
#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
|
||||
static int ngx_mail_ssl_alpn_select(ngx_ssl_conn_t *ssl_conn,
|
||||
@@ -33,6 +34,8 @@ static char *ngx_mail_ssl_session_cache(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||
static char *ngx_mail_ssl_conf_command_check(ngx_conf_t *cf, void *post,
|
||||
void *data);
|
||||
|
||||
+static char *ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||
+ void *conf);
|
||||
|
||||
static ngx_conf_enum_t ngx_mail_starttls_state[] = {
|
||||
{ ngx_string("off"), NGX_MAIL_STARTTLS_OFF },
|
||||
@@ -202,6 +205,13 @@ static ngx_command_t ngx_mail_ssl_commands[] = {
|
||||
offsetof(ngx_mail_ssl_conf_t, conf_commands),
|
||||
&ngx_mail_ssl_conf_command_post },
|
||||
|
||||
+ { ngx_string("ssl_pass_phrase_dialog"),
|
||||
+ NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1,
|
||||
+ ngx_conf_set_pass_phrase_dialog,
|
||||
+ NGX_MAIL_SRV_CONF_OFFSET,
|
||||
+ offsetof(ngx_mail_ssl_conf_t, pass_phrase_dialog),
|
||||
+ NULL },
|
||||
+
|
||||
ngx_null_command
|
||||
};
|
||||
|
||||
@@ -330,6 +340,8 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
{
|
||||
ngx_mail_ssl_conf_t *prev = parent;
|
||||
ngx_mail_ssl_conf_t *conf = child;
|
||||
+ ngx_mail_core_srv_conf_t *cscf;
|
||||
+ ngx_ssl_ppdialog_conf_t dlg;
|
||||
|
||||
char *mode;
|
||||
ngx_pool_cleanup_t *cln;
|
||||
@@ -372,6 +384,8 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
|
||||
ngx_conf_merge_ptr_value(conf->conf_commands, prev->conf_commands, NULL);
|
||||
|
||||
+ ngx_conf_merge_str_value(conf->pass_phrase_dialog,
|
||||
+ prev->pass_phrase_dialog, NGX_SSL_PASS_PHRASE_DEFAULT_VAL);
|
||||
|
||||
conf->ssl.log = cf->log;
|
||||
|
||||
@@ -430,6 +444,29 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
cln->handler = ngx_ssl_cleanup_ctx;
|
||||
cln->data = &conf->ssl;
|
||||
|
||||
+ /** directive format: ssl_pass_phrase_dialog builtin|exec:filepath */
|
||||
+ if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)"exec:", 5) == 0){
|
||||
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||
+ "ssl_pass_phrase_dialog config directive SET: %s ", conf->pass_phrase_dialog.data);
|
||||
+ } else if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)NGX_SSL_PASS_PHRASE_DEFAULT_VAL,
|
||||
+ sizeof(NGX_SSL_PASS_PHRASE_DEFAULT_VAL)) != 0){
|
||||
+
|
||||
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||
+ "ssl_pass_phrase_dialog config directive accepts only the following "
|
||||
+ "values: %s | exec:filepath", NGX_SSL_PASS_PHRASE_DEFAULT_VAL);
|
||||
+
|
||||
+ return NGX_CONF_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ cscf = ngx_mail_conf_get_module_srv_conf(cf, ngx_mail_core_module);
|
||||
+
|
||||
+ dlg.data = &conf->pass_phrase_dialog;
|
||||
+ if (cscf->server_name.len != 0) {
|
||||
+ dlg.server = &cscf->server_name;
|
||||
+ } else {
|
||||
+ dlg.server = &ngx_ssl_server_null;
|
||||
+ }
|
||||
+
|
||||
#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation
|
||||
SSL_CTX_set_alpn_select_cb(conf->ssl.ctx, ngx_mail_ssl_alpn_select, NULL);
|
||||
#endif
|
||||
@@ -442,7 +479,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
}
|
||||
|
||||
if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates,
|
||||
- conf->certificate_keys, conf->passwords)
|
||||
+ conf->certificate_keys, conf->passwords, &dlg)
|
||||
!= NGX_OK)
|
||||
{
|
||||
return NGX_CONF_ERROR;
|
||||
@@ -692,3 +729,30 @@ ngx_mail_ssl_conf_command_check(ngx_conf_t *cf, void *post, void *data)
|
||||
return NGX_CONF_OK;
|
||||
#endif
|
||||
}
|
||||
+
|
||||
+static char *
|
||||
+ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
|
||||
+{
|
||||
+ ngx_mail_ssl_conf_t *sscf = conf;
|
||||
+ ngx_str_t *value;
|
||||
+
|
||||
+ if (sscf->pass_phrase_dialog.data){
|
||||
+ return "is duplicate";
|
||||
+ }
|
||||
+
|
||||
+ value = cf->args->elts;
|
||||
+
|
||||
+ sscf->pass_phrase_dialog = value[1];
|
||||
+
|
||||
+ if (sscf->pass_phrase_dialog.len == 0) {
|
||||
+ return NGX_CONF_OK;
|
||||
+ } else if (sscf->pass_phrase_dialog.len > NGX_SSL_PASS_PHRASE_ARG_MAX_LEN) {
|
||||
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||
+ "ssl_pass_phrase_dialog argument length exceeded maximum possible length: %d",
|
||||
+ NGX_SSL_PASS_PHRASE_ARG_MAX_LEN);
|
||||
+
|
||||
+ return NGX_CONF_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ return NGX_CONF_OK;
|
||||
+}
|
||||
diff --git a/src/mail/ngx_mail_ssl_module.h b/src/mail/ngx_mail_ssl_module.h
|
||||
index c0eb6a3..02b4d4f 100644
|
||||
--- a/src/mail/ngx_mail_ssl_module.h
|
||||
+++ b/src/mail/ngx_mail_ssl_module.h
|
||||
@@ -56,6 +56,8 @@ typedef struct {
|
||||
|
||||
u_char *file;
|
||||
ngx_uint_t line;
|
||||
+
|
||||
+ ngx_str_t pass_phrase_dialog;
|
||||
} ngx_mail_ssl_conf_t;
|
||||
|
||||
|
||||
diff --git a/src/stream/ngx_stream_proxy_module.c b/src/stream/ngx_stream_proxy_module.c
|
||||
index ed275c0..1747aed 100644
|
||||
--- a/src/stream/ngx_stream_proxy_module.c
|
||||
+++ b/src/stream/ngx_stream_proxy_module.c
|
||||
@@ -2305,7 +2305,7 @@ ngx_stream_proxy_set_ssl(ngx_conf_t *cf, ngx_stream_proxy_srv_conf_t *pscf)
|
||||
if (ngx_ssl_certificate(cf, pscf->ssl,
|
||||
&pscf->ssl_certificate->value,
|
||||
&pscf->ssl_certificate_key->value,
|
||||
- pscf->ssl_passwords)
|
||||
+ pscf->ssl_passwords, NULL)
|
||||
!= NGX_OK)
|
||||
{
|
||||
return NGX_ERROR;
|
||||
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
|
||||
index ba44477..43cd7e0 100644
|
||||
--- a/src/stream/ngx_stream_ssl_module.c
|
||||
+++ b/src/stream/ngx_stream_ssl_module.c
|
||||
@@ -17,6 +17,8 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c,
|
||||
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
|
||||
#define NGX_DEFAULT_ECDH_CURVE "auto"
|
||||
|
||||
+#define NGX_SSL_STREAM_NAME "NGX_STREAM_SSL_MODULE"
|
||||
+static ngx_str_t ngx_ssl_stream_default_name = ngx_string(NGX_SSL_STREAM_NAME);
|
||||
|
||||
static ngx_int_t ngx_stream_ssl_handler(ngx_stream_session_t *s);
|
||||
static ngx_int_t ngx_stream_ssl_init_connection(ngx_ssl_t *ssl,
|
||||
@@ -57,6 +59,9 @@ static char *ngx_stream_ssl_alpn(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||
static char *ngx_stream_ssl_conf_command_check(ngx_conf_t *cf, void *post,
|
||||
void *data);
|
||||
|
||||
+static char *ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd,
|
||||
+ void *conf);
|
||||
+
|
||||
static ngx_int_t ngx_stream_ssl_init(ngx_conf_t *cf);
|
||||
|
||||
|
||||
@@ -233,6 +238,13 @@ static ngx_command_t ngx_stream_ssl_commands[] = {
|
||||
0,
|
||||
NULL },
|
||||
|
||||
+ { ngx_string("ssl_pass_phrase_dialog"),
|
||||
+ NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
|
||||
+ ngx_conf_set_pass_phrase_dialog,
|
||||
+ NGX_STREAM_SRV_CONF_OFFSET,
|
||||
+ offsetof(ngx_stream_ssl_srv_conf_t, pass_phrase_dialog),
|
||||
+ NULL },
|
||||
+
|
||||
ngx_null_command
|
||||
};
|
||||
|
||||
@@ -802,6 +814,7 @@ ngx_stream_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
{
|
||||
ngx_stream_ssl_srv_conf_t *prev = parent;
|
||||
ngx_stream_ssl_srv_conf_t *conf = child;
|
||||
+ ngx_ssl_ppdialog_conf_t dlg;
|
||||
|
||||
ngx_pool_cleanup_t *cln;
|
||||
|
||||
@@ -846,6 +859,8 @@ ngx_stream_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
|
||||
ngx_conf_merge_ptr_value(conf->conf_commands, prev->conf_commands, NULL);
|
||||
|
||||
+ ngx_conf_merge_str_value(conf->pass_phrase_dialog,
|
||||
+ prev->pass_phrase_dialog, NGX_SSL_PASS_PHRASE_DEFAULT_VAL);
|
||||
|
||||
conf->ssl.log = cf->log;
|
||||
|
||||
@@ -879,6 +894,23 @@ ngx_stream_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
cln->handler = ngx_ssl_cleanup_ctx;
|
||||
cln->data = &conf->ssl;
|
||||
|
||||
+ /** directive format: ssl_pass_phrase_dialog builtin|exec:filepath */
|
||||
+ if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)"exec:", 5) == 0){
|
||||
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||
+ "ssl_pass_phrase_dialog config directive SET: %s ", conf->pass_phrase_dialog.data);
|
||||
+ } else if (ngx_strncasecmp(conf->pass_phrase_dialog.data, (u_char *)NGX_SSL_PASS_PHRASE_DEFAULT_VAL,
|
||||
+ sizeof(NGX_SSL_PASS_PHRASE_DEFAULT_VAL)) != 0){
|
||||
+
|
||||
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||
+ "ssl_pass_phrase_dialog config directive accepts only the following "
|
||||
+ "values: %s | exec:filepath", NGX_SSL_PASS_PHRASE_DEFAULT_VAL);
|
||||
+
|
||||
+ return NGX_CONF_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ dlg.data = &conf->pass_phrase_dialog;
|
||||
+ dlg.server = &ngx_ssl_stream_default_name;
|
||||
+
|
||||
#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
|
||||
SSL_CTX_set_tlsext_servername_callback(conf->ssl.ctx,
|
||||
ngx_stream_ssl_servername);
|
||||
@@ -923,7 +955,7 @@ ngx_stream_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
/* configure certificates */
|
||||
|
||||
if (ngx_ssl_certificates(cf, &conf->ssl, conf->certificates,
|
||||
- conf->certificate_keys, conf->passwords)
|
||||
+ conf->certificate_keys, conf->passwords, &dlg)
|
||||
!= NGX_OK)
|
||||
{
|
||||
return NGX_CONF_ERROR;
|
||||
@@ -1371,3 +1403,30 @@ ngx_stream_ssl_init(ngx_conf_t *cf)
|
||||
|
||||
return NGX_OK;
|
||||
}
|
||||
+
|
||||
+static char *
|
||||
+ngx_conf_set_pass_phrase_dialog(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
|
||||
+{
|
||||
+ ngx_stream_ssl_srv_conf_t *sscf = conf;
|
||||
+ ngx_str_t *value;
|
||||
+
|
||||
+ if (sscf->pass_phrase_dialog.data){
|
||||
+ return "is duplicate";
|
||||
+ }
|
||||
+
|
||||
+ value = cf->args->elts;
|
||||
+
|
||||
+ sscf->pass_phrase_dialog = value[1];
|
||||
+
|
||||
+ if (sscf->pass_phrase_dialog.len == 0) {
|
||||
+ return NGX_CONF_OK;
|
||||
+ } else if (sscf->pass_phrase_dialog.len > NGX_SSL_PASS_PHRASE_ARG_MAX_LEN) {
|
||||
+ ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
|
||||
+ "ssl_pass_phrase_dialog argument length exceeded maximum possible length: %d",
|
||||
+ NGX_SSL_PASS_PHRASE_ARG_MAX_LEN);
|
||||
+
|
||||
+ return NGX_CONF_ERROR;
|
||||
+ }
|
||||
+
|
||||
+ return NGX_CONF_OK;
|
||||
+}
|
||||
diff --git a/src/stream/ngx_stream_ssl_module.h b/src/stream/ngx_stream_ssl_module.h
|
||||
index 6f6d9ae..870640d 100644
|
||||
--- a/src/stream/ngx_stream_ssl_module.h
|
||||
+++ b/src/stream/ngx_stream_ssl_module.h
|
||||
@@ -53,6 +53,8 @@ typedef struct {
|
||||
|
||||
ngx_flag_t session_tickets;
|
||||
ngx_array_t *session_ticket_keys;
|
||||
+
|
||||
+ ngx_str_t pass_phrase_dialog;
|
||||
} ngx_stream_ssl_srv_conf_t;
|
||||
|
||||
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -1,88 +0,0 @@
|
||||
From 4e5f12d6584536ead82d20554d8f3f2ab0107b0b Mon Sep 17 00:00:00 2001
|
||||
From: Lubos Uhliarik <luhliari@redhat.com>
|
||||
Date: Fri, 30 Apr 2021 13:07:45 +0000
|
||||
Subject: [PATCH 3/3] Support loading certificates from hardware token (PKCS#11)
|
||||
|
||||
---
|
||||
src/event/ngx_event_openssl.c | 65 +++++++++++++++++++++++++++++++++++
|
||||
1 file changed, 65 insertions(+)
|
||||
|
||||
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
|
||||
index d762d6b..270b200 100644
|
||||
--- a/src/event/ngx_event_openssl.c
|
||||
+++ b/src/event/ngx_event_openssl.c
|
||||
@@ -617,6 +617,71 @@ ngx_ssl_load_certificate(ngx_pool_t *pool, char **err, ngx_str_t *cert,
|
||||
X509 *x509, *temp;
|
||||
u_long n;
|
||||
|
||||
+ if (ngx_strncmp(cert->data, "engine:", sizeof("engine:") - 1) == 0) {
|
||||
+
|
||||
+#ifndef OPENSSL_NO_ENGINE
|
||||
+
|
||||
+ u_char *p, *last;
|
||||
+ ENGINE *engine;
|
||||
+
|
||||
+ p = cert->data + sizeof("engine:") - 1;
|
||||
+ last = (u_char *) ngx_strchr(p, ':');
|
||||
+
|
||||
+ if (last == NULL) {
|
||||
+ *err = "invalid syntax";
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ *last = '\0';
|
||||
+
|
||||
+ engine = ENGINE_by_id((char *) p);
|
||||
+
|
||||
+ if (engine == NULL) {
|
||||
+ *err = "ENGINE_by_id() failed";
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ if (!ENGINE_init(engine)) {
|
||||
+ *err = "ENGINE_init() failed";
|
||||
+ ENGINE_free(engine);
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ *last++ = ':';
|
||||
+
|
||||
+ struct {
|
||||
+ const char *cert_id;
|
||||
+ X509 *cert;
|
||||
+ } params = { (char *) last, NULL };
|
||||
+
|
||||
+ if (!ENGINE_ctrl_cmd(engine, "LOAD_CERT_CTRL", 0, ¶ms, NULL, 1)) {
|
||||
+ *err = "ENGINE_ctrl_cmd() failed - Unable to get the certificate";
|
||||
+ ENGINE_free(engine);
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ ENGINE_finish(engine);
|
||||
+ ENGINE_free(engine);
|
||||
+
|
||||
+ /* set chain to null */
|
||||
+
|
||||
+ *chain = sk_X509_new_null();
|
||||
+ if (*chain == NULL) {
|
||||
+ *err = "sk_X509_new_null() failed";
|
||||
+ X509_free(params.cert);
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ return params.cert;
|
||||
+
|
||||
+#else
|
||||
+
|
||||
+ *err = "loading \"engine:...\" certificate is not supported";
|
||||
+ return NULL;
|
||||
+
|
||||
+#endif
|
||||
+ }
|
||||
+
|
||||
if (ngx_strncmp(cert->data, "data:", sizeof("data:") - 1) == 0) {
|
||||
|
||||
bio = BIO_new_mem_buf(cert->data + sizeof("data:") - 1,
|
||||
--
|
||||
2.26.3
|
||||
|
||||
@ -0,0 +1,96 @@
|
||||
From 5dd0765607135a418289bc4a20060f31eeaede73 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
|
||||
Date: Tue, 2 Jul 2024 18:29:18 +0200
|
||||
Subject: [PATCH] Disable ENGINE support
|
||||
|
||||
---
|
||||
auto/options | 3 +++
|
||||
configure | 4 ++++
|
||||
src/event/ngx_event_openssl.c | 7 +++----
|
||||
src/event/ngx_event_openssl.h | 2 +-
|
||||
4 files changed, 11 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/auto/options b/auto/options
|
||||
index 6a6e990..3cc983d 100644
|
||||
--- a/auto/options
|
||||
+++ b/auto/options
|
||||
@@ -45,6 +45,8 @@ USE_THREADS=NO
|
||||
|
||||
NGX_FILE_AIO=NO
|
||||
|
||||
+NGX_SSL_NO_ENGINE=NO
|
||||
+
|
||||
QUIC_BPF=NO
|
||||
|
||||
HTTP=YES
|
||||
@@ -373,6 +375,7 @@ use the \"--with-mail_ssl_module\" option instead"
|
||||
|
||||
--with-openssl=*) OPENSSL="$value" ;;
|
||||
--with-openssl-opt=*) OPENSSL_OPT="$value" ;;
|
||||
+ --without-engine) NGX_SSL_NO_ENGINE=YES ;;
|
||||
|
||||
--with-md5=*)
|
||||
NGX_POST_CONF_MSG="$NGX_POST_CONF_MSG
|
||||
diff --git a/configure b/configure
|
||||
index 5b88ebb..3a2129e 100755
|
||||
--- a/configure
|
||||
+++ b/configure
|
||||
@@ -104,6 +104,10 @@ have=NGX_HTTP_UWSGI_TEMP_PATH value="\"$NGX_HTTP_UWSGI_TEMP_PATH\""
|
||||
have=NGX_HTTP_SCGI_TEMP_PATH value="\"$NGX_HTTP_SCGI_TEMP_PATH\""
|
||||
. auto/define
|
||||
|
||||
+if [ $NGX_SSL_NO_ENGINE = YES ]; then
|
||||
+ have=NGX_SSL_NO_ENGINE . auto/have
|
||||
+fi
|
||||
+
|
||||
. auto/make
|
||||
. auto/lib/make
|
||||
. auto/install
|
||||
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
|
||||
index 6f7f2a2..f939706 100644
|
||||
--- a/src/event/ngx_event_openssl.c
|
||||
+++ b/src/event/ngx_event_openssl.c
|
||||
@@ -842,7 +842,7 @@ ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err,
|
||||
|
||||
if (ngx_strncmp(key->data, "engine:", sizeof("engine:") - 1) == 0) {
|
||||
|
||||
-#ifndef OPENSSL_NO_ENGINE
|
||||
+#if !defined(OPENSSL_NO_ENGINE) && !defined(NGX_SSL_NO_ENGINE)
|
||||
|
||||
u_char *p, *last;
|
||||
ENGINE *engine;
|
||||
@@ -6119,8 +6119,7 @@ ngx_openssl_create_conf(ngx_cycle_t *cycle)
|
||||
static char *
|
||||
ngx_openssl_engine(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
|
||||
{
|
||||
-#ifndef OPENSSL_NO_ENGINE
|
||||
-
|
||||
+#if !defined(OPENSSL_NO_ENGINE) && !defined(NGX_SSL_NO_ENGINE)
|
||||
ngx_openssl_conf_t *oscf = conf;
|
||||
|
||||
ENGINE *engine;
|
||||
@@ -6170,7 +6169,7 @@ ngx_openssl_exit(ngx_cycle_t *cycle)
|
||||
#if OPENSSL_VERSION_NUMBER < 0x10100003L
|
||||
|
||||
EVP_cleanup();
|
||||
-#ifndef OPENSSL_NO_ENGINE
|
||||
+#if !defined(OPENSSL_NO_ENGINE) && !defined(NGX_SSL_NO_ENGINE)
|
||||
ENGINE_cleanup();
|
||||
#endif
|
||||
|
||||
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
|
||||
index 761f48d..c60b16d 100644
|
||||
--- a/src/event/ngx_event_openssl.h
|
||||
+++ b/src/event/ngx_event_openssl.h
|
||||
@@ -20,7 +20,7 @@
|
||||
#include <openssl/conf.h>
|
||||
#include <openssl/crypto.h>
|
||||
#include <openssl/dh.h>
|
||||
-#ifndef OPENSSL_NO_ENGINE
|
||||
+#if !defined(OPENSSL_NO_ENGINE) && !defined(NGX_SSL_NO_ENGINE)
|
||||
#include <openssl/engine.h>
|
||||
#endif
|
||||
#include <openssl/evp.h>
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -1,41 +0,0 @@
|
||||
From a769a35a6197c76390e1dd8f5054d426fbbbda05 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
|
||||
Date: Wed, 22 Sep 2021 16:12:58 +0200
|
||||
Subject: [PATCH] Init openssl engine properly
|
||||
|
||||
---
|
||||
src/event/ngx_event_openssl.c | 8 ++++++++
|
||||
1 file changed, 8 insertions(+)
|
||||
|
||||
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
|
||||
index 270b200..f813458 100644
|
||||
--- a/src/event/ngx_event_openssl.c
|
||||
+++ b/src/event/ngx_event_openssl.c
|
||||
@@ -798,16 +798,24 @@ ngx_ssl_load_certificate_key(ngx_pool_t *pool, char **err,
|
||||
return NULL;
|
||||
}
|
||||
|
||||
+ if (!ENGINE_init(engine)) {
|
||||
+ *err = "ENGINE_init() failed";
|
||||
+ ENGINE_free(engine);
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
*last++ = ':';
|
||||
|
||||
pkey = ENGINE_load_private_key(engine, (char *) last, 0, 0);
|
||||
|
||||
if (pkey == NULL) {
|
||||
*err = "ENGINE_load_private_key() failed";
|
||||
+ ENGINE_finish(engine);
|
||||
ENGINE_free(engine);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
+ ENGINE_finish(engine);
|
||||
ENGINE_free(engine);
|
||||
|
||||
return pkey;
|
||||
--
|
||||
2.31.1
|
||||
|
||||
@ -1,96 +0,0 @@
|
||||
From ee8ea4f1c88a0393206769cd30a545dc3375f868 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
|
||||
Date: Wed, 2 Feb 2022 20:14:55 +0100
|
||||
Subject: [PATCH] Fix ALPACA security issue
|
||||
|
||||
---
|
||||
src/mail/ngx_mail.h | 3 +++
|
||||
src/mail/ngx_mail_core_module.c | 10 ++++++++++
|
||||
src/mail/ngx_mail_handler.c | 15 ++++++++++++++-
|
||||
3 files changed, 27 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/mail/ngx_mail.h b/src/mail/ngx_mail.h
|
||||
index b865a3b..76cae37 100644
|
||||
--- a/src/mail/ngx_mail.h
|
||||
+++ b/src/mail/ngx_mail.h
|
||||
@@ -115,6 +115,8 @@ typedef struct {
|
||||
ngx_msec_t timeout;
|
||||
ngx_msec_t resolver_timeout;
|
||||
|
||||
+ ngx_uint_t max_errors;
|
||||
+
|
||||
ngx_str_t server_name;
|
||||
|
||||
u_char *file_name;
|
||||
@@ -231,6 +233,7 @@ typedef struct {
|
||||
ngx_uint_t command;
|
||||
ngx_array_t args;
|
||||
|
||||
+ ngx_uint_t errors;
|
||||
ngx_uint_t login_attempt;
|
||||
|
||||
/* used to parse POP3/IMAP/SMTP command */
|
||||
diff --git a/src/mail/ngx_mail_core_module.c b/src/mail/ngx_mail_core_module.c
|
||||
index 4083124..115671c 100644
|
||||
--- a/src/mail/ngx_mail_core_module.c
|
||||
+++ b/src/mail/ngx_mail_core_module.c
|
||||
@@ -85,6 +85,13 @@ static ngx_command_t ngx_mail_core_commands[] = {
|
||||
offsetof(ngx_mail_core_srv_conf_t, resolver_timeout),
|
||||
NULL },
|
||||
|
||||
+ { ngx_string("max_errors"),
|
||||
+ NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1,
|
||||
+ ngx_conf_set_num_slot,
|
||||
+ NGX_MAIL_SRV_CONF_OFFSET,
|
||||
+ offsetof(ngx_mail_core_srv_conf_t, max_errors),
|
||||
+ NULL },
|
||||
+
|
||||
ngx_null_command
|
||||
};
|
||||
|
||||
@@ -163,6 +170,8 @@ ngx_mail_core_create_srv_conf(ngx_conf_t *cf)
|
||||
cscf->timeout = NGX_CONF_UNSET_MSEC;
|
||||
cscf->resolver_timeout = NGX_CONF_UNSET_MSEC;
|
||||
|
||||
+ cscf->max_errors = NGX_CONF_UNSET_UINT;
|
||||
+
|
||||
cscf->resolver = NGX_CONF_UNSET_PTR;
|
||||
|
||||
cscf->file_name = cf->conf_file->file.name.data;
|
||||
@@ -182,6 +191,7 @@ ngx_mail_core_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
ngx_conf_merge_msec_value(conf->resolver_timeout, prev->resolver_timeout,
|
||||
30000);
|
||||
|
||||
+ ngx_conf_merge_uint_value(conf->max_errors, prev->max_errors, 5);
|
||||
|
||||
ngx_conf_merge_str_value(conf->server_name, prev->server_name, "");
|
||||
|
||||
diff --git a/src/mail/ngx_mail_handler.c b/src/mail/ngx_mail_handler.c
|
||||
index 0aaa0e7..71b8151 100644
|
||||
--- a/src/mail/ngx_mail_handler.c
|
||||
+++ b/src/mail/ngx_mail_handler.c
|
||||
@@ -871,7 +871,20 @@ ngx_mail_read_command(ngx_mail_session_t *s, ngx_connection_t *c)
|
||||
return NGX_MAIL_PARSE_INVALID_COMMAND;
|
||||
}
|
||||
|
||||
- if (rc == NGX_IMAP_NEXT || rc == NGX_MAIL_PARSE_INVALID_COMMAND) {
|
||||
+ if (rc == NGX_MAIL_PARSE_INVALID_COMMAND) {
|
||||
+
|
||||
+ s->errors++;
|
||||
+
|
||||
+ if (s->errors >= cscf->max_errors) {
|
||||
+ ngx_log_error(NGX_LOG_INFO, c->log, 0,
|
||||
+ "client sent too many invalid commands");
|
||||
+ s->quit = 1;
|
||||
+ }
|
||||
+
|
||||
+ return rc;
|
||||
+ }
|
||||
+
|
||||
+ if (rc == NGX_IMAP_NEXT) {
|
||||
return rc;
|
||||
}
|
||||
|
||||
--
|
||||
2.31.1
|
||||
|
||||
@ -1,173 +0,0 @@
|
||||
From cc7b92c61a2833ff9dc2b4dfba4591966769da78 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
|
||||
Date: Tue, 21 Jun 2022 13:55:04 +0200
|
||||
Subject: [PATCH] Enable TLSv1.3 by default in nginx
|
||||
|
||||
---
|
||||
src/event/ngx_event_openssl.c | 77 ++++++++++++++------------
|
||||
src/event/ngx_event_openssl.h | 1 +
|
||||
src/http/modules/ngx_http_ssl_module.c | 3 +-
|
||||
src/mail/ngx_mail_ssl_module.c | 3 +-
|
||||
src/stream/ngx_stream_ssl_module.c | 3 +-
|
||||
5 files changed, 46 insertions(+), 41 deletions(-)
|
||||
|
||||
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
|
||||
index f813458..2e6a6c0 100644
|
||||
--- a/src/event/ngx_event_openssl.c
|
||||
+++ b/src/event/ngx_event_openssl.c
|
||||
@@ -258,6 +258,8 @@ ngx_ssl_init(ngx_log_t *log)
|
||||
ngx_int_t
|
||||
ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
|
||||
{
|
||||
+ ngx_uint_t prot = NGX_SSL_NO_PROT;
|
||||
+
|
||||
ssl->ctx = SSL_CTX_new(SSLv23_method());
|
||||
|
||||
if (ssl->ctx == NULL) {
|
||||
@@ -322,49 +324,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
|
||||
|
||||
SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
|
||||
|
||||
-#if OPENSSL_VERSION_NUMBER >= 0x009080dfL
|
||||
- /* only in 0.9.8m+ */
|
||||
- SSL_CTX_clear_options(ssl->ctx,
|
||||
- SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1);
|
||||
-#endif
|
||||
-
|
||||
- if (!(protocols & NGX_SSL_SSLv2)) {
|
||||
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv2);
|
||||
- }
|
||||
- if (!(protocols & NGX_SSL_SSLv3)) {
|
||||
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv3);
|
||||
- }
|
||||
- if (!(protocols & NGX_SSL_TLSv1)) {
|
||||
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1);
|
||||
- }
|
||||
-#ifdef SSL_OP_NO_TLSv1_1
|
||||
- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
|
||||
- if (!(protocols & NGX_SSL_TLSv1_1)) {
|
||||
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
|
||||
- }
|
||||
+ if (protocols){
|
||||
+#ifdef SSL_OP_NO_TLSv1_3
|
||||
+ if (protocols & NGX_SSL_TLSv1_3) {
|
||||
+ prot = TLS1_3_VERSION;
|
||||
+ } else
|
||||
#endif
|
||||
#ifdef SSL_OP_NO_TLSv1_2
|
||||
- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
|
||||
- if (!(protocols & NGX_SSL_TLSv1_2)) {
|
||||
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
|
||||
- }
|
||||
+ if (protocols & NGX_SSL_TLSv1_2) {
|
||||
+ prot = TLS1_2_VERSION;
|
||||
+ } else
|
||||
#endif
|
||||
-#ifdef SSL_OP_NO_TLSv1_3
|
||||
- SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
|
||||
- if (!(protocols & NGX_SSL_TLSv1_3)) {
|
||||
- SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
|
||||
- }
|
||||
+#ifdef SSL_OP_NO_TLSv1_1
|
||||
+ if (protocols & NGX_SSL_TLSv1_1) {
|
||||
+ prot = TLS1_1_VERSION;
|
||||
+ } else
|
||||
#endif
|
||||
+ if (protocols & NGX_SSL_TLSv1) {
|
||||
+ prot = TLS1_VERSION;
|
||||
+ }
|
||||
+
|
||||
+ if (prot == NGX_SSL_NO_PROT) {
|
||||
+ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
|
||||
+ "No SSL protocols available [hint: ssl_protocols]");
|
||||
+ return NGX_ERROR;
|
||||
+ }
|
||||
|
||||
-#ifdef SSL_CTX_set_min_proto_version
|
||||
- SSL_CTX_set_min_proto_version(ssl->ctx, 0);
|
||||
- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION);
|
||||
+ SSL_CTX_set_max_proto_version(ssl->ctx, prot);
|
||||
+
|
||||
+ /* Now, we have to scan for minimal protocol version,
|
||||
+ *without allowing holes between min and max*/
|
||||
+#ifdef SSL_OP_NO_TLSv1_3
|
||||
+ if ((prot == TLS1_3_VERSION) && (protocols & NGX_SSL_TLSv1_2)) {
|
||||
+ prot = TLS1_2_VERSION;
|
||||
+ }
|
||||
#endif
|
||||
|
||||
-#ifdef TLS1_3_VERSION
|
||||
- SSL_CTX_set_min_proto_version(ssl->ctx, 0);
|
||||
- SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION);
|
||||
+#ifdef SSL_OP_NO_TLSv1_1
|
||||
+ if ((prot == TLS1_2_VERSION) && (protocols & NGX_SSL_TLSv1_1)) {
|
||||
+ prot = TLS1_1_VERSION;
|
||||
+ }
|
||||
+#endif
|
||||
+#ifdef SSL_OP_NO_TLSv1_2
|
||||
+ if ((prot == TLS1_1_VERSION) && (protocols & NGX_SSL_TLSv1)) {
|
||||
+ prot = TLS1_VERSION;
|
||||
+ }
|
||||
#endif
|
||||
+ SSL_CTX_set_min_proto_version(ssl->ctx, prot);
|
||||
+ }
|
||||
|
||||
#ifdef SSL_OP_NO_COMPRESSION
|
||||
SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION);
|
||||
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
|
||||
index 329760d..5cee113 100644
|
||||
--- a/src/event/ngx_event_openssl.h
|
||||
+++ b/src/event/ngx_event_openssl.h
|
||||
@@ -152,6 +152,7 @@ typedef struct {
|
||||
#endif
|
||||
|
||||
|
||||
+#define NGX_SSL_NO_PROT 0x0000
|
||||
#define NGX_SSL_SSLv2 0x0002
|
||||
#define NGX_SSL_SSLv3 0x0004
|
||||
#define NGX_SSL_TLSv1 0x0008
|
||||
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
|
||||
index a47d696..94f30db 100644
|
||||
--- a/src/http/modules/ngx_http_ssl_module.c
|
||||
+++ b/src/http/modules/ngx_http_ssl_module.c
|
||||
@@ -671,8 +671,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0);
|
||||
|
||||
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
|
||||
- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
|
||||
- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
|
||||
+ 0)
|
||||
|
||||
ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size,
|
||||
NGX_SSL_BUFSIZE);
|
||||
diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c
|
||||
index 7eae83e..8328560 100644
|
||||
--- a/src/mail/ngx_mail_ssl_module.c
|
||||
+++ b/src/mail/ngx_mail_ssl_module.c
|
||||
@@ -306,8 +306,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
prev->prefer_server_ciphers, 0);
|
||||
|
||||
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
|
||||
- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
|
||||
- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
|
||||
+ 0);
|
||||
|
||||
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
|
||||
ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
|
||||
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
|
||||
index d8c0471..cef590d 100644
|
||||
--- a/src/stream/ngx_stream_ssl_module.c
|
||||
+++ b/src/stream/ngx_stream_ssl_module.c
|
||||
@@ -641,8 +641,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
|
||||
prev->prefer_server_ciphers, 0);
|
||||
|
||||
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
|
||||
- (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
|
||||
- |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
|
||||
+ 0);
|
||||
|
||||
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
|
||||
ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
|
||||
--
|
||||
2.31.1
|
||||
|
||||
@ -1,74 +0,0 @@
|
||||
From b6aa9504cdfb6391d895dcbddc87b9260ea6968c Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
|
||||
Date: Wed, 11 Oct 2023 09:59:23 +0200
|
||||
Subject: [PATCH] CVE-2023-44487 - HTTP/2: per-iteration stream handling limit.
|
||||
|
||||
To ensure that attempts to flood servers with many streams are detected
|
||||
early, a limit of no more than 2 * max_concurrent_streams new streams per one
|
||||
event loop iteration was introduced. This limit is applied even if
|
||||
max_concurrent_streams is not yet reached - for example, if corresponding
|
||||
streams are handled synchronously or reset.
|
||||
|
||||
Further, refused streams are now limited to maximum of max_concurrent_streams
|
||||
and 100, similarly to priority_limit initial value, providing some tolerance
|
||||
to clients trying to open several streams at the connection start, yet
|
||||
low tolerance to flooding attempts.
|
||||
---
|
||||
src/http/v2/ngx_http_v2.c | 15 +++++++++++++++
|
||||
src/http/v2/ngx_http_v2.h | 2 ++
|
||||
2 files changed, 17 insertions(+)
|
||||
|
||||
|
||||
diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
|
||||
index 3611a2e..291677a 100644
|
||||
--- a/src/http/v2/ngx_http_v2.c
|
||||
+++ b/src/http/v2/ngx_http_v2.c
|
||||
@@ -361,6 +361,7 @@ ngx_http_v2_read_handler(ngx_event_t *rev)
|
||||
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http2 read handler");
|
||||
|
||||
h2c->blocked = 1;
|
||||
+ h2c->new_streams = 0;
|
||||
|
||||
if (c->close) {
|
||||
c->close = 0;
|
||||
@@ -1320,6 +1321,14 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
|
||||
goto rst_stream;
|
||||
}
|
||||
|
||||
+ if (h2c->new_streams++ >= 2 * h2scf->concurrent_streams) {
|
||||
+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
|
||||
+ "client sent too many streams at once");
|
||||
+
|
||||
+ status = NGX_HTTP_V2_REFUSED_STREAM;
|
||||
+ goto rst_stream;
|
||||
+ }
|
||||
+
|
||||
if (!h2c->settings_ack
|
||||
&& !(h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG)
|
||||
&& h2scf->preread_size < NGX_HTTP_V2_DEFAULT_WINDOW)
|
||||
@@ -1385,6 +1394,12 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos,
|
||||
|
||||
rst_stream:
|
||||
|
||||
+ if (h2c->refused_streams++ > ngx_max(h2scf->concurrent_streams, 100)) {
|
||||
+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0,
|
||||
+ "client sent too many refused streams");
|
||||
+ return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_NO_ERROR);
|
||||
+ }
|
||||
+
|
||||
if (ngx_http_v2_send_rst_stream(h2c, h2c->state.sid, status) != NGX_OK) {
|
||||
return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR);
|
||||
}
|
||||
diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h
|
||||
index 3492297..6a7aaa6 100644
|
||||
--- a/src/http/v2/ngx_http_v2.h
|
||||
+++ b/src/http/v2/ngx_http_v2.h
|
||||
@@ -125,6 +125,8 @@ struct ngx_http_v2_connection_s {
|
||||
ngx_uint_t processing;
|
||||
ngx_uint_t frames;
|
||||
ngx_uint_t idle;
|
||||
+ ngx_uint_t new_streams;
|
||||
+ ngx_uint_t refused_streams;
|
||||
ngx_uint_t priority_limit;
|
||||
|
||||
ngx_uint_t pushing;
|
||||
@ -1,183 +0,0 @@
|
||||
From f3bcc0bcfb6eda3f4874fe2531d546ba724c518c Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
|
||||
Date: Wed, 12 Jun 2024 12:49:28 +0200
|
||||
Subject: [PATCH] Optimized chain link usage
|
||||
|
||||
Previously chain links could sometimes be dropped instead of being reused,
|
||||
which could result in increased memory consumption during long requests.
|
||||
---
|
||||
src/core/ngx_output_chain.c | 10 ++++++++--
|
||||
src/http/modules/ngx_http_grpc_module.c | 5 ++++-
|
||||
.../modules/ngx_http_gunzip_filter_module.c | 18 ++++++++++++++----
|
||||
src/http/modules/ngx_http_gzip_filter_module.c | 10 +++++++---
|
||||
src/http/modules/ngx_http_ssi_filter_module.c | 8 ++++++--
|
||||
src/http/modules/ngx_http_sub_filter_module.c | 8 ++++++--
|
||||
6 files changed, 45 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/src/core/ngx_output_chain.c b/src/core/ngx_output_chain.c
|
||||
index 5c3dbe8..4aa1b02 100644
|
||||
--- a/src/core/ngx_output_chain.c
|
||||
+++ b/src/core/ngx_output_chain.c
|
||||
@@ -121,7 +121,10 @@ ngx_output_chain(ngx_output_chain_ctx_t *ctx, ngx_chain_t *in)
|
||||
|
||||
ngx_debug_point();
|
||||
|
||||
- ctx->in = ctx->in->next;
|
||||
+ cl = ctx->in;
|
||||
+ ctx->in = cl->next;
|
||||
+
|
||||
+ ngx_free_chain(ctx->pool, cl);
|
||||
|
||||
continue;
|
||||
}
|
||||
@@ -207,7 +210,10 @@ ngx_output_chain(ngx_output_chain_ctx_t *ctx, ngx_chain_t *in)
|
||||
/* delete the completed buf from the ctx->in chain */
|
||||
|
||||
if (ngx_buf_size(ctx->in->buf) == 0) {
|
||||
- ctx->in = ctx->in->next;
|
||||
+ cl = ctx->in;
|
||||
+ ctx->in = cl->next;
|
||||
+
|
||||
+ ngx_free_chain(ctx->pool, cl);
|
||||
}
|
||||
|
||||
cl = ngx_alloc_chain_link(ctx->pool);
|
||||
diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c
|
||||
index 53bc547..9f13089 100644
|
||||
--- a/src/http/modules/ngx_http_grpc_module.c
|
||||
+++ b/src/http/modules/ngx_http_grpc_module.c
|
||||
@@ -1230,7 +1230,7 @@ ngx_http_grpc_body_output_filter(void *data, ngx_chain_t *in)
|
||||
ngx_buf_t *b;
|
||||
ngx_int_t rc;
|
||||
ngx_uint_t next, last;
|
||||
- ngx_chain_t *cl, *out, **ll;
|
||||
+ ngx_chain_t *cl, *out, *ln, **ll;
|
||||
ngx_http_upstream_t *u;
|
||||
ngx_http_grpc_ctx_t *ctx;
|
||||
ngx_http_grpc_frame_t *f;
|
||||
@@ -1458,7 +1458,10 @@ ngx_http_grpc_body_output_filter(void *data, ngx_chain_t *in)
|
||||
last = 1;
|
||||
}
|
||||
|
||||
+ ln = in;
|
||||
in = in->next;
|
||||
+
|
||||
+ ngx_free_chain(r->pool, ln);
|
||||
}
|
||||
|
||||
ctx->in = in;
|
||||
diff --git a/src/http/modules/ngx_http_gunzip_filter_module.c b/src/http/modules/ngx_http_gunzip_filter_module.c
|
||||
index c1341f5..5d170a1 100644
|
||||
--- a/src/http/modules/ngx_http_gunzip_filter_module.c
|
||||
+++ b/src/http/modules/ngx_http_gunzip_filter_module.c
|
||||
@@ -333,6 +333,8 @@ static ngx_int_t
|
||||
ngx_http_gunzip_filter_add_data(ngx_http_request_t *r,
|
||||
ngx_http_gunzip_ctx_t *ctx)
|
||||
{
|
||||
+ ngx_chain_t *cl;
|
||||
+
|
||||
if (ctx->zstream.avail_in || ctx->flush != Z_NO_FLUSH || ctx->redo) {
|
||||
return NGX_OK;
|
||||
}
|
||||
@@ -344,8 +346,11 @@ ngx_http_gunzip_filter_add_data(ngx_http_request_t *r,
|
||||
return NGX_DECLINED;
|
||||
}
|
||||
|
||||
- ctx->in_buf = ctx->in->buf;
|
||||
- ctx->in = ctx->in->next;
|
||||
+ cl = ctx->in;
|
||||
+ ctx->in_buf = cl->buf;
|
||||
+ ctx->in = cl->next;
|
||||
+
|
||||
+ ngx_free_chain(r->pool, cl);
|
||||
|
||||
ctx->zstream.next_in = ctx->in_buf->pos;
|
||||
ctx->zstream.avail_in = ctx->in_buf->last - ctx->in_buf->pos;
|
||||
@@ -374,6 +379,7 @@ static ngx_int_t
|
||||
ngx_http_gunzip_filter_get_buf(ngx_http_request_t *r,
|
||||
ngx_http_gunzip_ctx_t *ctx)
|
||||
{
|
||||
+ ngx_chain_t *cl;
|
||||
ngx_http_gunzip_conf_t *conf;
|
||||
|
||||
if (ctx->zstream.avail_out) {
|
||||
@@ -383,8 +389,12 @@ ngx_http_gunzip_filter_get_buf(ngx_http_request_t *r,
|
||||
conf = ngx_http_get_module_loc_conf(r, ngx_http_gunzip_filter_module);
|
||||
|
||||
if (ctx->free) {
|
||||
- ctx->out_buf = ctx->free->buf;
|
||||
- ctx->free = ctx->free->next;
|
||||
+
|
||||
+ cl = ctx->free;
|
||||
+ ctx->out_buf = cl->buf;
|
||||
+ ctx->free = cl->next;
|
||||
+
|
||||
+ ngx_free_chain(r->pool, cl);
|
||||
|
||||
ctx->out_buf->flush = 0;
|
||||
|
||||
diff --git a/src/http/modules/ngx_http_gzip_filter_module.c b/src/http/modules/ngx_http_gzip_filter_module.c
|
||||
index b8c5ccc..1d17a6d 100644
|
||||
--- a/src/http/modules/ngx_http_gzip_filter_module.c
|
||||
+++ b/src/http/modules/ngx_http_gzip_filter_module.c
|
||||
@@ -978,10 +978,14 @@ static void
|
||||
ngx_http_gzip_filter_free_copy_buf(ngx_http_request_t *r,
|
||||
ngx_http_gzip_ctx_t *ctx)
|
||||
{
|
||||
- ngx_chain_t *cl;
|
||||
+ ngx_chain_t *cl, *ln;
|
||||
+
|
||||
+ for (cl = ctx->copied; cl; /* void */) {
|
||||
+ ln = cl;
|
||||
+ cl = cl->next;
|
||||
|
||||
- for (cl = ctx->copied; cl; cl = cl->next) {
|
||||
- ngx_pfree(r->pool, cl->buf->start);
|
||||
+ ngx_pfree(r->pool, ln->buf->start);
|
||||
+ ngx_free_chain(r->pool, ln);
|
||||
}
|
||||
|
||||
ctx->copied = NULL;
|
||||
diff --git a/src/http/modules/ngx_http_ssi_filter_module.c b/src/http/modules/ngx_http_ssi_filter_module.c
|
||||
index 6737965..a55f6e5 100644
|
||||
--- a/src/http/modules/ngx_http_ssi_filter_module.c
|
||||
+++ b/src/http/modules/ngx_http_ssi_filter_module.c
|
||||
@@ -455,9 +455,13 @@ ngx_http_ssi_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
|
||||
while (ctx->in || ctx->buf) {
|
||||
|
||||
if (ctx->buf == NULL) {
|
||||
- ctx->buf = ctx->in->buf;
|
||||
- ctx->in = ctx->in->next;
|
||||
+
|
||||
+ cl = ctx->in;
|
||||
+ ctx->buf = cl->buf;
|
||||
+ ctx->in = cl->next;
|
||||
ctx->pos = ctx->buf->pos;
|
||||
+
|
||||
+ ngx_free_chain(r->pool, cl);
|
||||
}
|
||||
|
||||
if (ctx->state == ssi_start_state) {
|
||||
diff --git a/src/http/modules/ngx_http_sub_filter_module.c b/src/http/modules/ngx_http_sub_filter_module.c
|
||||
index 6d3de59..456bb27 100644
|
||||
--- a/src/http/modules/ngx_http_sub_filter_module.c
|
||||
+++ b/src/http/modules/ngx_http_sub_filter_module.c
|
||||
@@ -335,9 +335,13 @@ ngx_http_sub_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
|
||||
while (ctx->in || ctx->buf) {
|
||||
|
||||
if (ctx->buf == NULL) {
|
||||
- ctx->buf = ctx->in->buf;
|
||||
- ctx->in = ctx->in->next;
|
||||
+
|
||||
+ cl = ctx->in;
|
||||
+ ctx->buf = cl->buf;
|
||||
+ ctx->in = cl->next;
|
||||
ctx->pos = ctx->buf->pos;
|
||||
+
|
||||
+ ngx_free_chain(r->pool, cl);
|
||||
}
|
||||
|
||||
if (ctx->buf->flush || ctx->buf->recycled) {
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -1,120 +0,0 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
|
||||
|
||||
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
|
||||
<head>
|
||||
<title>The page is not found</title>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
|
||||
<style type="text/css">
|
||||
/*<![CDATA[*/
|
||||
body {
|
||||
background-color: #fff;
|
||||
color: #000;
|
||||
font-size: 0.9em;
|
||||
font-family: sans-serif,helvetica;
|
||||
margin: 0;
|
||||
padding: 0;
|
||||
}
|
||||
:link {
|
||||
color: #c00;
|
||||
}
|
||||
:visited {
|
||||
color: #c00;
|
||||
}
|
||||
a:hover {
|
||||
color: #f50;
|
||||
}
|
||||
h1 {
|
||||
text-align: center;
|
||||
margin: 0;
|
||||
padding: 0.6em 2em 0.4em;
|
||||
background-color: #900;
|
||||
color: #fff;
|
||||
font-weight: normal;
|
||||
font-size: 1.75em;
|
||||
border-bottom: 2px solid #000;
|
||||
}
|
||||
h1 strong {
|
||||
font-weight: bold;
|
||||
font-size: 1.5em;
|
||||
}
|
||||
h2 {
|
||||
text-align: center;
|
||||
background-color: #900;
|
||||
font-size: 1.1em;
|
||||
font-weight: bold;
|
||||
color: #fff;
|
||||
margin: 0;
|
||||
padding: 0.5em;
|
||||
border-bottom: 2px solid #000;
|
||||
}
|
||||
h3 {
|
||||
text-align: center;
|
||||
background-color: #ff0000;
|
||||
padding: 0.5em;
|
||||
color: #fff;
|
||||
}
|
||||
hr {
|
||||
display: none;
|
||||
}
|
||||
.content {
|
||||
padding: 1em 5em;
|
||||
}
|
||||
.alert {
|
||||
border: 2px solid #000;
|
||||
}
|
||||
|
||||
img {
|
||||
border: 2px solid #fff;
|
||||
padding: 2px;
|
||||
margin: 2px;
|
||||
}
|
||||
a:hover img {
|
||||
border: 2px solid #294172;
|
||||
}
|
||||
.logos {
|
||||
margin: 1em;
|
||||
text-align: center;
|
||||
}
|
||||
/*]]>*/
|
||||
</style>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<h1><strong>nginx error!</strong></h1>
|
||||
|
||||
<div class="content">
|
||||
|
||||
<h3>The page you are looking for is not found.</h3>
|
||||
|
||||
<div class="alert">
|
||||
<h2>Website Administrator</h2>
|
||||
<div class="content">
|
||||
<p>Something has triggered missing webpage on your
|
||||
website. This is the default 404 error page for
|
||||
<strong>nginx</strong> that is distributed with
|
||||
Red Hat Enterprise Linux. It is located
|
||||
<tt>/usr/share/nginx/html/404.html</tt></p>
|
||||
|
||||
<p>You should customize this error page for your own
|
||||
site or edit the <tt>error_page</tt> directive in
|
||||
the <strong>nginx</strong> configuration file
|
||||
<tt>/etc/nginx/nginx.conf</tt>.</p>
|
||||
|
||||
<p>For information on Red Hat Enterprise Linux, please visit the <a href="http://www.redhat.com/">Red Hat, Inc. website</a>. The documentation for Red Hat Enterprise Linux is <a href="http://www.redhat.com/docs/manuals/enterprise/">available on the Red Hat, Inc. website</a>.</p>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="logos">
|
||||
<a href="http://nginx.net/"><img
|
||||
src="nginx-logo.png"
|
||||
alt="[ Powered by nginx ]"
|
||||
width="121" height="32" /></a>
|
||||
<a href="http://www.redhat.com/"><img
|
||||
src="poweredby.png"
|
||||
alt="[ Powered by Red Hat Enterprise Linux ]"
|
||||
width="88" height="31" /></a>
|
||||
</div>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
@ -1,120 +0,0 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
|
||||
|
||||
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
|
||||
<head>
|
||||
<title>The page is temporarily unavailable</title>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
|
||||
<style type="text/css">
|
||||
/*<![CDATA[*/
|
||||
body {
|
||||
background-color: #fff;
|
||||
color: #000;
|
||||
font-size: 0.9em;
|
||||
font-family: sans-serif,helvetica;
|
||||
margin: 0;
|
||||
padding: 0;
|
||||
}
|
||||
:link {
|
||||
color: #c00;
|
||||
}
|
||||
:visited {
|
||||
color: #c00;
|
||||
}
|
||||
a:hover {
|
||||
color: #f50;
|
||||
}
|
||||
h1 {
|
||||
text-align: center;
|
||||
margin: 0;
|
||||
padding: 0.6em 2em 0.4em;
|
||||
background-color: #900;
|
||||
color: #fff;
|
||||
font-weight: normal;
|
||||
font-size: 1.75em;
|
||||
border-bottom: 2px solid #000;
|
||||
}
|
||||
h1 strong {
|
||||
font-weight: bold;
|
||||
font-size: 1.5em;
|
||||
}
|
||||
h2 {
|
||||
text-align: center;
|
||||
background-color: #900;
|
||||
font-size: 1.1em;
|
||||
font-weight: bold;
|
||||
color: #fff;
|
||||
margin: 0;
|
||||
padding: 0.5em;
|
||||
border-bottom: 2px solid #000;
|
||||
}
|
||||
h3 {
|
||||
text-align: center;
|
||||
background-color: #ff0000;
|
||||
padding: 0.5em;
|
||||
color: #fff;
|
||||
}
|
||||
hr {
|
||||
display: none;
|
||||
}
|
||||
.content {
|
||||
padding: 1em 5em;
|
||||
}
|
||||
.alert {
|
||||
border: 2px solid #000;
|
||||
}
|
||||
|
||||
img {
|
||||
border: 2px solid #fff;
|
||||
padding: 2px;
|
||||
margin: 2px;
|
||||
}
|
||||
a:hover img {
|
||||
border: 2px solid #294172;
|
||||
}
|
||||
.logos {
|
||||
margin: 1em;
|
||||
text-align: center;
|
||||
}
|
||||
/*]]>*/
|
||||
</style>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<h1><strong>nginx error!</strong></h1>
|
||||
|
||||
<div class="content">
|
||||
|
||||
<h3>The page you are looking for is temporarily unavailable. Please try again later.</h3>
|
||||
|
||||
<div class="alert">
|
||||
<h2>Website Administrator</h2>
|
||||
<div class="content">
|
||||
<p>Something has triggered missing webpage on your
|
||||
website. This is the default error page for
|
||||
<strong>nginx</strong> that is distributed with
|
||||
Red Hat Enterprise Linux. It is located
|
||||
<tt>/usr/share/nginx/html/50x.html</tt></p>
|
||||
|
||||
<p>You should customize this error page for your own
|
||||
site or edit the <tt>error_page</tt> directive in
|
||||
the <strong>nginx</strong> configuration file
|
||||
<tt>/etc/nginx/nginx.conf</tt>.</p>
|
||||
|
||||
<p>For information on Red Hat Enterprise Linux, please visit the <a href="http://www.redhat.com/">Red Hat, Inc. website</a>. The documentation for Red Hat Enterprise Linux is <a href="http://www.redhat.com/docs/manuals/enterprise/">available on the Red Hat, Inc. website</a>.</p>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="logos">
|
||||
<a href="http://nginx.net/"><img
|
||||
src="nginx-logo.png"
|
||||
alt="[ Powered by nginx ]"
|
||||
width="121" height="32" /></a>
|
||||
<a href="http://www.redhat.com/"><img
|
||||
src="poweredby.png"
|
||||
alt="[ Powered by Red Hat Enterprise Linux ]"
|
||||
width="88" height="31" /></a>
|
||||
</div>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
@ -0,0 +1,114 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQINBGYXyiQBEAC4jm1y+ODV4+YDGj9vp2BgHB4FJeQdgrBiVX+Mb2qCrEqJgeKV
|
||||
fVwKjkVYqnb76TTybdOKqCP5wdQrncKAKlXsMq6sdsiwPSrdRcjkeiE29WWrtbB4
|
||||
i+VObnoWklMblMxFQ1XQIkjs2wviidKjJw2VV3i4XnLSrHhWaWqviTLZCMQymoPs
|
||||
F+Tfu1WX9OUfOquekZ5KjkyBxB4ep6+NPeuIkPnW0SiTUhU8tbi8v0aBZEHSZLqE
|
||||
mq8KLROVuYSPvtU+NtaXAM09BHEVCfb409aDps9p6AFT+IN8yoOegGdEZjp6hJvS
|
||||
HxbhuwqNEtg4dTEV515YUCgKabqU1QaqI/Y0+Pdkpep1KRFc9YUYttDkCw7Ybu2u
|
||||
fwTGzwAbD+ThAIOdzmMDodzZaEMf+9fQG4bnO1PdNbXzyP7Kv9qzGa65+9oGCPOS
|
||||
qTpISR8pvzoI8w/Z/vG71ob/nQ6Xm0L986ksErdGhu16ZI7lW2eDYqy2IoFfbeSz
|
||||
HHxk484/pEibrlCRbP2Id+zULfxo1HGOGg+PAY9Q2uNzABsGDMnOhIvXHS+hP7oB
|
||||
sO9A4Prqu6K6cMp3QI219tmmOUegJpmGGPzoNgxR7H30wNcjZPv4PWr/c0fP70Ny
|
||||
ilgbdcEMDSHks30AmiuIvcUxo3A21p2nnpxsKAKYx42UJkyEK0HILMzcqwARAQAB
|
||||
tCZSb21hbiBBcnV0eXVueWFuIDxyLmFydXR5dW55YW5AZjUuY29tPokCTgQTAQgA
|
||||
OBYhBEM4eCXdsbuX7Da6XQB8jXwV2HNpBQJmF8pXAhsDBQsJCAcCBhUKCQgLAgQW
|
||||
AgMBAh4BAheAAAoJEAB8jXwV2HNppvQP/AjzdPKkGRzJkb1ioto/IEP1YhA/Eayk
|
||||
hvejJ0vyWVHXXH7FLW9fIZoApcsD1J8/7zIANm+62IfT3QNbL2R44IyhJB3AY22l
|
||||
t0ToLxodfugegF3NPYYyFOSRUoPD4g2T/dMCPOBX4MNEAnAlCmxAMaJNmQUO76IY
|
||||
GwELa3CH3Aqf7bthKy8P36G11hu7NgH6V9mVIRIpfnfpXFQIztj+vsWtswu4M5t7
|
||||
BNJwx4a2KTCVQpTdff5/0dO/5drQDxLbIg681WZk3Oe8Eu6nSc0Ud02NIkg1TQH/
|
||||
MryAp7o/ua3LRem+W/cktnT60p4uXPVZ3Rvg3zOmJSNJ+eIXY2+sDeZEPaROKldA
|
||||
IbnBacTsZjdswIlrbzinY8ZVRosaFlvHg/ESTBRItALHWCRdzOR1Wv1qy/PQfEEL
|
||||
qftDsCTQhssP1MHJWlejeqPlND3iT2vBDeOxqd6WhKuAc+L04iyBB6p867pwrgDF
|
||||
ecg82DPehsAnO2XBAFuIE/SLewkYm0B9HK7/J4LZqPwTAksPf/dnbMAmHWoBDqsu
|
||||
4U4U4SsJKsZ87R9ao8qO7IWCzHrXavHFmnbqweFfHToeKF/L4PB+tYoW3YmUOged
|
||||
CglpJv13bNWmRwL7+x8b7BwpVwClxHBHteDX4RIN5iPH9h20J4jIpzRa1kNJsTu1
|
||||
v4ZkqLWJlkiiiQEzBBABCAAdFiEEcziXMGntP0Q/TTffpk/VsXrbOagFAmYdpjsA
|
||||
CgkQpk/VsXrbOahISgf/U7ZO0yK0PsOcAFTB0TQBCNsAhxtJAEJoVoweuYiLk8jR
|
||||
0OeDRCy0BC//qWDLFT7NKuP50SM2u0Csbg+n6b0bdy+vXbbGVzIAYzG09rPYe2Q5
|
||||
qwqyAx+MMzyICXul9lGNU2qN2qjUXMb0mCWUhxwMvzRUeS7shT1CBhGrnpoYkY56
|
||||
NhWj7iG1BbLwYVQzDZC/Rp6rvwJQgZo7+DjaMjryGAEI0ujpUp8ywrPaJpwIuXDI
|
||||
D5BhcyUaEd3XOondHQNedlgERXHT4pN+oNMPWwN3+DeQYLS3FHiqyz05ZvoeWnao
|
||||
A2/fWNA+BqIdjilp/TDDI4Ef7c9hp13weaZggYB3M4kBMwQQAQgAHRYhBFc7/Ws9
|
||||
j7xkEHmmq6v1vYJ72b9iBQJmHabkAAoJEKv1vYJ72b9iDgoIAP1QJjl4ynLAV9Bo
|
||||
Ol4AAzxZ3x/2NEgLSnjLfhb/OduDxQlL9oPulWoLDG41xiZJkepEnQWmSsIYF6Xe
|
||||
RsAB+eREU2uCxqCvBXpyIs5npXvVDV2/PQuVEop7HByx6Hjr9XK8hugihnEi1p+9
|
||||
Ecbu+89fi93m3C/5uIIil46cHByjRZ+5Yy1UFUB/wsYud1qMcYmvDaqEo5AqWNcM
|
||||
gWUFhUfgGTtBbyvIWTeX0NHnrbzHP7lhmPfWsfOjAtO8PpM8Gz5RdNRq44DdRKdG
|
||||
uWVby/kni868H+8/tHalDR0I9/Mmg2Uax0eggTVpECv/4+xBduqSB2iPwgRnSzhZ
|
||||
6SVKJvKJAjMEEAEIAB0WIQT5TVS8DF1qZBfIzz/oLBEYr5TfbgUCZh5KVgAKCRDo
|
||||
LBEYr5TfbitgD/wMamMFfFZnPS7JS1NWEMb5fbhHob1EkmedIpbpRDXUtj0ksehW
|
||||
ZAEpmVF9btqS4B+B9tSK1VS2sy4XwEGodNVSGxdtF9W8+iAHAb6Hq1Z7ifWyb991
|
||||
Kt/pVk/8adxlU4G8h1fq0idhpnI8KvkAlPJR7+PoJOEN1+VdHS6tkE5LMTf6dF9F
|
||||
iVxKQczOS1b/GmfL3kYfu6UvI07ZuaP+90mOt/TZTwkzsWjRY2vofCIPSDY94rLj
|
||||
m6PmVFoU3PHLKW7yDz1YXkVE6SgQYGZ2bqB6OHJZnDXUTSHncHTbDVzZQekIs1lP
|
||||
V6e5N8Xo/VOpv28feKAsBqQ8ML53djmGUL0azjEz1g2kgPmTuZdKzZ5kcUsULdQV
|
||||
aRKcfyYD1oRpwwlw9GJAxliJHck1IdGGaCslrHtzkh3RMULlloAYitzD9jtKsrOj
|
||||
R19s+JK/tIfFZZ5gR5qhzgOL8WgkSrIaq2o9R4sigBz1IxnXXC573RDA2F5FAeE/
|
||||
K6EmAO+BqVkImZcmP1JsLtr+OM+jihXIILACEJwhOKPtZth9zrLYkXWB1nCaDxHp
|
||||
XEUpp6UPCQNgNX8NCghnJr5gis/SmYppgFlO9R9yZ7/LtP0tUX0CmhOeqGMnHt4R
|
||||
F8n8D7EBwMWvWjlUbsDkMKX4JORgojguHJZciWQC1gVRwJ0iTH/ImtzDnbQhUm9t
|
||||
YW4gQXJ1dHl1bnlhbiA8YXJ1dEBuZ2lueC5jb20+iQJOBBMBCAA4FiEEQzh4Jd2x
|
||||
u5fsNrpdAHyNfBXYc2kFAmYXyiQCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AA
|
||||
CgkQAHyNfBXYc2kRFw//VFuCnW3EwoLCWWgWCikgI9kbVDr0/Qiyf2Gb9sfOyzBN
|
||||
q/+ZGjTs7EqTHbYUiCTgjy8t0SNKizoCXjSWLToTAXhOeTY3wDuHkdc3C2OPMPgm
|
||||
HPGmdnfplmsZjj689sy0MTnlLmU/87texR/f3REAKtchVjo5AojuZxXJi+ryBvoz
|
||||
KXi82M1JaYlIr15T+OiRtfZ3cgfTkb5CRa0YRV7QQ1zhOiF0AFKVVikFwRuquphT
|
||||
y2cSLILLzOpwG/CjMJzO4VOASmGJmdicIfYSsZSzz37RrcfeYwR6quJ55Y9QF9IU
|
||||
fg5AHWufpXaf6FbMsW1U1mOq0tMvwvdcO+u5I5SBj6IkqO4zavmW/i5zkxaq96wF
|
||||
Qn6+oRkqHnNNn0hl/B4MWdEjDJsaDXfkQ3Snn4Bfl1JPT6cH2NDVYQn1siIOim/W
|
||||
G5lhGLNB1TOAVLHblQ2xILadK0T33y6lfRUV3BOW01BDoF0ndyd7LjG5Di/cjfSo
|
||||
1hvhTkW7QJGfzVV4IAAxEyHKlmgONfggZoplqukuPsq7eNNRPhvlZq632QXIqt6Y
|
||||
xE43Nk0O41rX/tWtB7eNcPvfNOc+sGljnCSwpRWyx9xO7plELVD9KdtcyHrIgora
|
||||
Flh7KsSbppSQ/iUKRNP+lfCQsMa1yrnQyxazss8OGlB7YpUJL4trQW35f/jXFD+J
|
||||
ATMEEAEIAB0WIQRzOJcwae0/RD9NN9+mT9Wxets5qAUCZh2mQQAKCRCmT9Wxets5
|
||||
qPBjB/0SDkET7h/Vw2PJKxuYujsL+tn3SKXshgyCM2u00njJM9TqpZbZV681unKM
|
||||
l8uHtj9b0Z4U0nHoNEC37wI5FJlxy1hLBw5f2fd/yi8LsD1KP2htjMUW+I2xjcdo
|
||||
FusQsIF0s8SyW1DZ3vvN2WcZpKHwub1sY9ZFBfxRc6w+33N4dJwXVXP57kj3Ci8j
|
||||
LDLfkaKyiuYgMtFYZiKKX0tfvaM5pXxLvLOzma9vwfjIMIllooZHDSI65jrbmMv0
|
||||
rfDKOX9Ws5Xi8n85jq6Oyq28QPLZUsmymCbhvBwq4FcdiyTl9sxCY4HLq0MzmJJ5
|
||||
DMhlFd2Ds3BopFTWCB2fvYyVoXRaiQEzBBABCAAdFiEEVzv9az2PvGQQeaarq/W9
|
||||
gnvZv2IFAmYdpugACgkQq/W9gnvZv2Jk4Qf+N0P/7FIHowlO01XmBB5KaztBmVb2
|
||||
Tj+jtYgPDHRf86O0kW40Rjx++zMlIRNWK4Ue5PKAi82Yue5uvZcVlpWpx/sMvL+N
|
||||
C4Xds3Q3qnkxkoemoIMqUKGvePjBpyUWArBkBQ3FrvZtywnzyFWNrvOpeM+5HIuz
|
||||
WBri/SHBHzQm1/Jl2r5pHcbUdSxB2o1v3f+SaS2vGxwigIf8v44pRfyeWgkoxYgN
|
||||
+2zR0Ing6URZCYkAbwILsmmWGxJIuq+N9Xs1CQ1WZd5S78p/JBMDQ1prUDLCLFMc
|
||||
AvlZpQ0HvzEbKGiIVNa1LEQRF4ZWjQOHaPJhg/D3r/Q7VaFlgsOqrwtQaYkCMwQQ
|
||||
AQgAHRYhBPlNVLwMXWpkF8jPP+gsERivlN9uBQJmHkpZAAoJEOgsERivlN9u8fYQ
|
||||
AK0s0CvQNTXrg/Oe92Ajj+CpFIGhEUgXsufpg3OF+4doXOoRrVcv6y/0dGC+u899
|
||||
Qiz5rzP8JkgT3Bvs/oFbQnESX7zob/GuBiRAnaanQQGjQsc8tXUcIgIB8vZI6Hxr
|
||||
BZYyjXMrc1fAp1zy6F3YfVtjntp6Zt740zlcFSHPL6pKeNC8lCas7f7EPGm9ERlf
|
||||
XvPOsMyKVDRTrtYVrQ17pgmWzMFl9eYzAV81X/cK7O9BmTvLb9HB9THl9QM6iKWd
|
||||
UPNNhMseMA55i1y1trvv2rQSP2tm7xAijlffNu/LHyVjOJA+63rk9JqpQi2O/sI6
|
||||
naCZ5kLky3+OisbzJLtsIv3KWGF4jnpZJwPI97UbRAxrBCPd8BDXW06qQ0xfF9GA
|
||||
sW46IDnf5uNV5Fj9T1IhZUUCU6XwwhcTENwcaJ2hubPzW19gvxieRpxdvnXhjUxR
|
||||
UgqgFjtlpyBSABYr2REiaBTHkR1qVMa8tThpSyzfmfBNe9chBGQBdDMzTTUDf4dU
|
||||
cw4UGGPXqrBEapleoZBszXLrZxQxCNmLGFBW3vcJDfRRTvg/OMCIwD72kfd8KY1t
|
||||
SRRi5vQ3CvV8E0EEXshjxVk0fwS+5muM1thWZM4xCSgyH6Ka/5biMeUv1VNcKJne
|
||||
J51xs9jfS/JltrT/ahWG4J9msJFtmYyrLh/nMxccXK75uQINBGYXyiQBEAC5tT5O
|
||||
uysy75BcwAg8jIK+Cw6hNy+riOoCIzsMen8ps4tyDFLmRdpJmVOpmtvESaix2MHf
|
||||
Hc/t9hOsQ8LmF3kDG/JisDXcB/v28EOiDpp5Ug/5UOFBnbu4DkxbakJF8KF/rQ9t
|
||||
i29lt03saGCf2XbqzTLI6FvZ2TT8hDwAZF5aOtDEHV3ChBPn6gplnJADiZ9DioMZ
|
||||
ji1HnL8Zu4IYHMNOgpxULi6TMhBH/MkHbyycOdt/EsQFamnLGeV8KR2fubYjrpbH
|
||||
pLZzSRepQyvKIhHAFj6DUeDyEt2XAitxI8YI40IVO75Zu8ZZq0qYGML8Am+t6ZjJ
|
||||
3ZR8/DWjxRUYeo+YVEe5f+oRl5GRNkLtGvTAD38Nb2/7SUYdSXA3y3Ocfo/bySwa
|
||||
qggeFpDqK5eHXmrO4hvRqYoEyNyW4VQlGyvYq4s2cLeCF/S2w6dV8OFsksIoq8uq
|
||||
R1/IQ8Bonsf7iAYpsMAZZOGKiJzr01W3GA4Ka3B/MmZP5CysUhFlFxMsDr3/TWfg
|
||||
p3CHd5yGAnuWWWkjqVQzx0tcub3gyDsHCPuws8P2OKJ2lzNPqpp08MjYMMRZb4Y6
|
||||
9REXkKw7kXU8zM5+1IpW2U+z83NU86QR08PTpjATz05ltdGqF82Z+Ygl2nav8oqV
|
||||
RqNd/k+WE60e1eJmgykjmz6nPbm0S2jt1C7QLQARAQABiQI2BBgBCAAgFiEEQzh4
|
||||
Jd2xu5fsNrpdAHyNfBXYc2kFAmYXyiQCGwwACgkQAHyNfBXYc2mTihAAqB+sv9lw
|
||||
kRorE6iXwvvj2Dt2iIy7jc1AhZQOH/j7B4GHpV3Ej/ptdUwuzj/aX5EnEeDPZ2JU
|
||||
sSKy2q0RpKGKdKOvgy5yVfd8xqujkawXv26QU53mgyfgQCZLhFFhq0MIAqnxPb8h
|
||||
SCQeol18Wqs++LjeDMwkgMrHJeNhW2U2llqTS37YfRMOo0Vr022ZHlMlkyMz1sQH
|
||||
+C2/nzmmtkI4+vlPeccoN+3239YzndW1+XM8S3dXNcsGTyLAbkCowfpuqQdIP0MY
|
||||
lBwx/Xj9fxBNAuqGVCjrjGMg7mozMkeCDzrAoZiaD3Kud8zSs9VpAyAymrPQJSSS
|
||||
96b+vr2mDKbV11QJeJZv/d02n4JMjK7Ai//3j/TqkJF4UoYH45g5hvGSrym1UKrf
|
||||
n8TqHdtTFjcxAMXLbWICHdDk7/0ole8Bl8csiSHyKy/sGJ0b/7zcB88CS8OfsR3C
|
||||
OanK13emeD6rHOp8wEWA1/PA1JoAC5suS/uIgPWa5ujLaViJ9pW6ohfzMqOtLABF
|
||||
BB/FgD/qgPF+uTPPLQZw3XO8Q61kFq6x0RJGNgBEOpseounx+T6FCxZqrvjWm/WK
|
||||
VQUiRBtJIvD7Z8UCP+NUzdj3hwLAXpXrPz0gkcbI+hdlTJHCC6i61Qf5OIWnhtw6
|
||||
kZv2zEcTtzlAYNEumy8KrJzICmPLS7BEC8w=
|
||||
=ilJ3
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
@ -1,33 +0,0 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
Version: GnuPG v1.4.11 (FreeBSD)
|
||||
|
||||
mQENBE7SKu8BCADQo6x4ZQfAcPlJMLmL8zBEBUS6GyKMMMDtrTh3Yaq481HB54oR
|
||||
0cpKL05Ff9upjrIzLD5TJUCzYYM9GQOhguDUP8+ZU9JpSz3yO2TvH7WBbUZ8FADf
|
||||
hblmmUBLNgOWgLo3W+FYhl3mz1GFS2Fvid6Tfn02L8CBAj7jxbjL1Qj/OA/WmLLc
|
||||
m6BMTqI7IBlYW2vyIOIHasISGiAwZfp0ucMeXXvTtt14LGa8qXVcFnJTdwbf03AS
|
||||
ljhYrQnKnpl3VpDAoQt8C68YCwjaNJW59hKqWB+XeIJ9CW98+EOAxLAFszSyGanp
|
||||
rCqPd0numj9TIddjcRkTA/ZbmCWK+xjpVBGXABEBAAG0IU1heGltIERvdW5pbiA8
|
||||
bWRvdW5pbkBtZG91bmluLnJ1PokBOAQTAQIAIgUCTtIq7wIbAwYLCQgHAwIGFQgC
|
||||
CQoLBBYCAwECHgECF4AACgkQUgqZk6HAUvj+iwf/b4FS6zVzJ5T0v1vcQGD4ZzXe
|
||||
D5xMC4BJW414wVMU15rfX7aCdtoCYBNiApPxEd7SwiyxWRhRA9bikUq87JEgmnyV
|
||||
0iYbHZvCvc1jOkx4WR7E45t1Mi29KBoPaFXA9X5adZkYcOQLDxa2Z8m6LGXnlF6N
|
||||
tJkxQ8APrjZsdrbDvo3HxU9muPcq49ydzhgwfLwpUs11LYkwB0An9WRPuv3jporZ
|
||||
/XgI6RfPMZ5NIx+FRRCjn6DnfHboY9rNF6NzrOReJRBhXCi6I+KkHHEnMoyg8XET
|
||||
9lVkfHTOl81aIZqrAloX3/00TkYWyM2zO9oYpOg6eUFCX/Lw4MJZsTcT5EKVxIhG
|
||||
BBARAgAGBQJO01Y/AAoJEOzw6QssFyCDVyQAn3qwTZlcZgyyzWu9Cs8gJ0CXREaS
|
||||
AJ92QjGLT9DijTcbB+q9OS/nl16Z/IhGBBARAgAGBQJO02JDAAoJEKk3YTmlJMU+
|
||||
P64AnjCKEXFelSVMtgefJk3+vpyt3QX1AKCH9M3MbTWPeDUL+MpULlfdyfvjj7kB
|
||||
DQRO0irvAQgA0LjCc8S6oZzjiap2MjRNhRFA5BYjXZRZBdKF2VP74avt2/RELq8G
|
||||
W0n7JWmKn6vvrXabEGLyfkCngAhTq9tJ/K7LPx/bmlO5+jboO/1inH2BTtLiHjAX
|
||||
vicXZk3oaZt2Sotx5mMI3yzpFQRVqZXsi0LpUTPJEh3oS8IdYRjslQh1A7P5hfCZ
|
||||
wtzwb/hKm8upODe/ITUMuXeWfLuQj/uEU6wMzmfMHb+jlYMWtb+v98aJa2FODeKP
|
||||
mWCXLa7bliXp1SSeBOEfIgEAmjM6QGlDx5sZhr2Ss2xSPRdZ8DqD7oiRVzmstX1Y
|
||||
oxEzC0yXfaefC7SgM0nMnaTvYEOYJ9CH3wARAQABiQEfBBgBAgAJBQJO0irvAhsM
|
||||
AAoJEFIKmZOhwFL4844H/jo8icCcS6eOWvnen7lg0FcCo1fIm4wW3tEmkQdchSHE
|
||||
CJDq7pgTloN65pwB5tBoT47cyYNZA9eTfJVgRc74q5cexKOYrMC3KuAqWbwqXhkV
|
||||
s0nkWxnOIidTHSXvBZfDFA4Idwte94Thrzf8Pn8UESudTiqrWoCBXk2UyVsl03gJ
|
||||
blSJAeJGYPPeo+Yj6m63OWe2+/S2VTgmbPS/RObn0Aeg7yuff0n5+ytEt2KL51gO
|
||||
QE2uIxTCawHr12PsllPkbqPk/PagIttfEJqn9b0CrqPC3HREePb2aMJ/Ctw/76CO
|
||||
wn0mtXeIXLCTvBmznXfaMKllsqbsy2nCJ2P2uJjOntw=
|
||||
=Tavt
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
@ -1,10 +0,0 @@
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQEcBAABCAAGBQJgrPDQAAoJEFIKmZOhwFL4dlIH/RFvUn4wiazXVujdm1df2/Q5
|
||||
b+NVlr+O9WZ2Mb35dooOshG/G2wVjI95Cd5NU6svulJ05uv6tGgHA0CUZP6PLqIm
|
||||
4os5QcgbEbfdDbfQEw7wyc831DqiBPwzk/xt954vsqwzX3mkXvUNTEYpynguwN1J
|
||||
2iMb/bFRSlLZkKGbKOmLMO7iav0r88qtpmQIzG1mFTDg3leH0q3hEMAJl7pIicYd
|
||||
Of3+/EHnM8CXORtA1q6YTLbcHAzhSmjdrMyw+RQGQkxoPtdj9vwL4Z6Wk8+6dDK7
|
||||
dVBaiKp80tDM/iJizPbkbrBVbnR/9W48+QBC7tmOJMuj2c1Q/kvwJg9CLyHlqCU=
|
||||
=tPti
|
||||
-----END PGP SIGNATURE-----
|
||||
@ -0,0 +1,17 @@
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQJHBAABCAAxFiEE1nhs4wPZqQIpmNxsyEZNVJr3XAoFAmZXPGUTHHMua2FuZGF1
|
||||
cm92QGY1LmNvbQAKCRDIRk1UmvdcCiG1EACWP/IqUfdcEWWUkKnP8PSDGOKgxTfB
|
||||
2lbWjs/rC+iDhk4dMKfponRyNseRAEtvWMdliLLErtkoja5wQEuhulVKjZ5zqnDv
|
||||
T91M/5sqYK/EL6G3vkIwekxEDmWtkCJKw1aKNBgYKqOrRao3dEOSYpUUWfVM2wWW
|
||||
sLcaCAsJGslAY9dogYGOWr1fF7LJSSSk1Arz/3DonTfUhLL0N+6u1KEi1yxwEWSR
|
||||
1Vs7DPXeuL8Kgn6zBxSNFESdYbBb8QwqUN1dSDgUPFSIlw/n0JFC8qzoAb69ym3i
|
||||
3uL3V7RrtE6ADILaQToLSN7kyhRtzgUFDdphyYIY0/PtTfNhtEjxP8XqW/CLugBn
|
||||
NYseAfQIE63gsP+HgTmJ8EE6+mSeDDyLBDrPu/9op8MoRT1TAza6EL/6OnFOP6cy
|
||||
BPF1DJb3vxaiBwxMbw87lYhiTQNRcmih3O6kve65YatW/4ZvDax5z0nQSiOIaPz2
|
||||
jRlukJcGQqLHrHaQnwcKJgv/fUKH5Mv9sVPnb6YlIBaHgIsoKoQWEtjatbpBUM1u
|
||||
72u5HdxTqWF5JnaLZOxuNt5APo8ioevteja3LFIjl0bcl0B48MldnlvOO8TXU5nN
|
||||
lHgwx+0TFW8Q7jPxjr9UhSefQ9mWRv2XbrWcj6IdGfSHTWiLi2xoOzWTjcFrRLDI
|
||||
xmmig1zTp8F8oA==
|
||||
=GTyw
|
||||
-----END PGP SIGNATURE-----
|
||||
@ -0,0 +1,3 @@
|
||||
#!/bin/sh
|
||||
|
||||
exec /bin/systemd-ask-password "Enter TLS private key passphrase for $1 ($2) : "
|
||||
@ -0,0 +1,65 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQINBGKE4psBEADpHSM/IxFD1nXBmnODYXzcl2A+6b6m9m1m2Y4Dlr0ed+y5Lxne
|
||||
QidE9I74A2KSm6+eHW2yh4i1ZwZbmwpmQqM+j5BMt7axoXOdKSyN+fYtUakzNbBN
|
||||
EDRKT79q/zIzkgTJradHkCQkwF1W3go+qPXjR2ZEnLma9dZED9VNI6PmOpeYaASo
|
||||
IkEfbKbwa/vPrvnDSSYY6Y02RXSRk5U1NvQgVUTJP9WGK7NlPUcTBDELLQv6fFPU
|
||||
kjBOel6MecsQ+v8iq4RJF2cbVF0hNjbAiNldjLV74Xd7yWVRlCbdb2agyvQjMNrD
|
||||
jHSvbEMiNB3R8yBHVW2Zldv8q0XjcwoDfdiZYFJe3lRUYmv6I2p+/DptD4r/3ILI
|
||||
peGZtSeOdQEw+vvODL/Ehq03anTrzcpZ6sDLfLrYJhYcrltj0/LMUnLDAjciwRUq
|
||||
XI46EfxwqsdLeqoZFQeO3LOFsh0kJKR2xOrUHIVy84NJ4Gmro6WmUkb1NfdjyHzF
|
||||
z8Lfbo46NKoTcwFsFF0q74jVVIVNUyIS91DusiMqLCsP8jqDOz/kyP4bOJQ+aUXf
|
||||
BANn4Ll1TFWsJ417moxz+Pi5sTaI0na8z2XB1N9WPsSml3FS75hJPJshN2T3VIea
|
||||
zB7GFWqk33ynSDt+cAisG5nsK9fFdcH+t5wm59oobyFbFhKxwX6ROuxlZwARAQAB
|
||||
tCRTZXJnZXkgS2FuZGF1cm92IDxwbHVrbmV0QG5naW54LmNvbT6JAk4EEwEKADgW
|
||||
IQTWeGzjA9mpAimY3GzIRk1UmvdcCgUCYoTimwIbAwULCQgHAwUVCgkICwUWAwIB
|
||||
AAIeAQIXgAAKCRDIRk1UmvdcCqbOD/9Htgk3mWvUFmrApkWQTIDNmLACZ1Sw1PXj
|
||||
Uqte8StYB0bYY+nmAXs7O5eC2h1ViParl7En1joEEMQQmH0qSnw4X1CM/hA8TAYW
|
||||
mBPITTNWo/R52WoyWeWGFnFNIperQmuIZc+pXm0VEFVPiX/2DXbCIu+jaXySvlCN
|
||||
LekmOD4VC7dJS8/ohoaXOR2T8ufS+1CsyPXomEb+COhqRZ3EVBa+k7pnElkFft3Y
|
||||
a1fR0AgatZFQpy+ukePhK7s/M5RGhDJWHgSAZFkf+X2jVV4NRJ+XsY80gU5DD2ZX
|
||||
QT6Je6Knxqk7FnWNSxkhReH6Ss5flZSoGDCmJ2AsPtGeUhus2fGqeN+waGKTZC35
|
||||
die2V4/cro1SWswSI6Y5GFDZT1olIUztPmSXU/A3oyizJI7XZybwUbpk5kK83VXm
|
||||
el3U/7Qr/VErlDWFefZWeUvT1RILZ8IRoNj4dv158RnKHt9G508A5qz4hUPKoSeq
|
||||
SiXhYwfkc31WPzIJ4ev+X5Ka2sG/CKbEMJ7qwc0Kadiu+ePPfqqbXjpTWRyrbcRM
|
||||
hRNcLNUi1SLWMBClOQG+5GNG1dPPHkbj4dO1OZuaUMwQdu8R8NlsGoVWS40bmVv5
|
||||
pXstzYCl7k/UnC/Ytlq61GeAoq8ILa6jGj0EWqlhvi0ZNMN+fROhzrRlTzIr/+WE
|
||||
Xf8EiVNFSbQlU2VyZ2V5IEthbmRhdXJvdiA8cy5rYW5kYXVyb3ZAZjUuY29tPokC
|
||||
TgQTAQoAOBYhBNZ4bOMD2akCKZjcbMhGTVSa91wKBQJihO2zAhsDBQsJCAcDBRUK
|
||||
CQgLBRYDAgEAAh4BAheAAAoJEMhGTVSa91wKgLQQANaf4UMndkWoefDQPkJ5qR4K
|
||||
fuV0WRz59riZEApTkVpPXzl8Y1i8Rgt9pa1v1i12vPyIXKav1rJXQcuDEzqrhQ2G
|
||||
yvuAE2U/t2mYaMUmwxWO2d8JA3slvBSgOkiYpbLooDizAdKMT5UQWGyw31Wm51iz
|
||||
HjoztebsyXeXgq9VDjv3D8LUBr/OY3Hguj6HV+zRtC95qgXYadW2FiCtvBK6RTDb
|
||||
iShTuseLSheGh9dZIUSnzaOiJpDA61ZDYtFZxSpe67vEzhSfHVsF+ZdCjoWhhVv+
|
||||
+2wR4E0VQQtOM9uX1PMlZ5Ymr02/gidsXCM0ZjYXx4cDDhnq+nKomN64VloXWY9t
|
||||
PIi86XmzcSWlGUd+Ac6LyW7/f64bUWs4Ih0Idl0PF0sAr/6axKUsIs1nbn5MEtXk
|
||||
ZPAjcDLqLb9IIQaXRurm/il8v+bLXVBOJq33YUuGRuz8pu4vPA5Q97zglqhlIgbu
|
||||
prHMJ9hl5q39JwS3As2rK0o6Q9VVKr29rqSEfk4wEttvk0QMMU5zEvVl8MtqPj42
|
||||
qURqpHOadFbYMTwhUmRBUszRZPa5/pWqq0gWOtpyCWFVAsHFWQGJM1Eo6gGEyHZM
|
||||
YgBp+d29p2p409r1+06U67GBnXvUy0RyIpkLQtU+lyOJ6vvrBmmsDs/gc69GnlSC
|
||||
tZmCt0pLesJ7ZJzGdDkduQINBGKE4psBEADQr/enuDeVT11v6ejuYrg7aaZaGFUe
|
||||
3i28bQ4pRUKNfxs7zVYDDHi2i2bhS5j2yQnbsQtGcgoenw6lapmdQRzr4vjQAz9o
|
||||
kT6l4qpqvFFQM0wZTnigVDmmO9vTHR8Uk3iCKTd2ax3oko/xPWWYJautJ6ex8cOA
|
||||
coHSDeOjuIWSxCKq0BDFp6LoxkM8nuyLAX2cbhI3LncaZhVveMeN+Fmcsv+WpkKs
|
||||
yhX92umZuGwlraSyFy23FiRWSZPu9qVIxMMHvVrQJIgfhyWaHFzoF4M4qDoSKx92
|
||||
uWfUWgFwPOxOJ6/YcPsX4T8qTl9htmwPN0BibPTlcWaIFXtiU5bE1MivUPeACrI/
|
||||
gwUfCR3Mg+GYc13C6jzepREUhI7PLi3+A203PlMZd/aaSZkP6j+h4cwdapH5P4uF
|
||||
7T1EQ0MSdx3neAvu5p0IM6JpriwxfT3HsG+Y952T6MIeXcjNRebsBrygJhJ0/vyr
|
||||
wV5t8jL0yQty4CiE/QFnBs42l+rngi7K7Y1AZRBGK7JA09XaoLrfLmS+PrbYPsaJ
|
||||
flkM8GzUB7BBCLozxDHPzmPkf/A1w3XHZnYuZmS+pvjWCIoKpLQHI99oSUGho/TR
|
||||
gMRO4v7EAzluqCiepMl0xwFfHB115ND/mATazc4Pt6FxUsqffzfZrN01e1UVPrp5
|
||||
4x6YLO80JnOY6QARAQABiQI2BBgBCgAgFiEE1nhs4wPZqQIpmNxsyEZNVJr3XAoF
|
||||
AmKE4psCGwwACgkQyEZNVJr3XAp9ghAAgCgErxQYn/Lh/mzsxYXPnisggcBpceks
|
||||
mGw7knj1EGkXqq9CHn3EjCw8dB5N857UFlUr++DHwpFL5O36PRQo33RIUFbmBypG
|
||||
8C/xX1jWGu3xcaqS3P1ncsSSl6ckdvy9pjMxThm/RkXO0eJCn7FcanwPJXEB3Pbb
|
||||
mm0wLI2OXl/m7l5QAr7kErnPvGNzcbX6G35Q/MY8mumBWQ9H53R5ZPpi+OS40Wfn
|
||||
pZNKdh/Acwa7+2RokPqoOcJfxVdBOUigXTzb45qZgqEsSR7bkZAy2E80A/sJKPqs
|
||||
OGjp9cog3rBYyNBn5dasfR9KeBtluKnjUbzutXsQoKUSECY00YGrtneSXMku5hoE
|
||||
Dguk68w/L63ZApYHO/JTgJAYvqPOErAVUegPIw2CT1/2qi5vpClBcKkNS7RXrssA
|
||||
X+lElE0zbzX3bNG+lQuXby7jNUFYltkEiz6vTtc4HuHy8u40DHMswzkoDr0T8IE0
|
||||
7ZRAWXwV1nlA/dI337cHCsWMJyqem5wZZO13iqe07qaCg1uvBPeqDo81hOCn1us7
|
||||
l5SYRUTlt7KSFEHZ+Sx4bmVneAuRi5okaQdmrepy/ss/vVpRwWuQxsPkvT8boS7s
|
||||
mqOVsZFcNOuUJPUyOz1dHUL6FMYpk1dw+9n41gO4fLBzJekFTB/fxL6SRbYFWWn7
|
||||
x0VGHDmuaYQ=
|
||||
=HmVo
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
@ -0,0 +1,147 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQGNBFrwMiUBDADo56OlDknN+ReCMP+8CN1biK5izmGd755TxktHLI9nAP8ociIq
|
||||
Hjrps22pBtAIQ6eZpwCFBys2mR/441rOgZW+O6uqBYrttbxTMvE43EmKYGuFCmuR
|
||||
u0JGMPuqnzF3Y+6uoKzqMzazSrZIBWsBKAkNYTw8+yPlxGgffhBp1ueME7Lskglh
|
||||
EV9gmrEM0QlWod7wSQvyruExPm5INx3MG63Xfvc0bPiWUOGKyMb7kXA5VgnWuzmS
|
||||
BCMm17+A32vMyxhYcvSEgUayQjGghI1uPDSqBQBMEFTgSK2wWzvAXf/M45nxKBgQ
|
||||
IEDmvoC8RM9JTtUr7RE/E1mjsuefF2vYYYsWBstRFGAlUV1/lPNNibu3NqbCug6b
|
||||
1IWJuV1DX9T9/f81GZJrsPgYYKC6Ai8C1B0NGWjos7/GzgEFENQgf5duOhFPadQz
|
||||
QbRxBoId4Fe/Uwe2HxI8ESCQMwsq8bowcCn6XRA2EYkAt17Kab6LH6tTP54XG9TL
|
||||
bV7bAhyrvZAk1lUAEQEAAbQjS29uc3RhbnRpbiBQYXZsb3YgPGsucGF2bG92QGY1
|
||||
LmNvbT6JAdcEEwEIAEECGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AWIQQT
|
||||
yCpjtgNXYVbjCk6g6pgbZrDZZwUCYoTfvAUJEPqvFwAKCRCg6pgbZrDZZxFYDADK
|
||||
R02XgC+AoyrqMwBNXC8Y6aiilEsyppsgj+KwZcGKDYN488gEmff+/KIEdtglw3I3
|
||||
tCMbo+FzFjHveeVCb0qrIMerWJg+o4YrxxqlQ9Q1InpduKLrIuGae0J1ybITS8+v
|
||||
iYAmwzy1Wb2CDDuCnhCR/QDfOE1CvRILVqIKezC0tRrBTEvRO84m6YMBtJ1DP75Z
|
||||
2cTNyjPos9+uxi4JcMKrMUBwZKya+z5i+Uxd66wuPj9KmggNG1x+bqMWmpTrSKUn
|
||||
gbLabFUth+uWumpj3/7HBT8Ov7rPgzY/vn3Fn5mKdLQm+kRwSX9/FbtHAE3Qsm+f
|
||||
6WW8CZ4XzL9ONfhQYwO2Jrq4HzgYloZkL+1Zs61X+zeEyr4o/mzt5DHbQRsD1UzQ
|
||||
gnh7t3YdSAy6gBqevjPWkQlq9e8eoFRydN/htwjS7dleikOsYktSnTIKlRXAWGCm
|
||||
jkRpQyZYuuPcWcGRt/0MVewRJmLemH6O+NviqhgGRePO9QR0R+yfdCwewPJEDk6J
|
||||
AjMEEAEKAB0WIQTWeGzjA9mpAimY3GzIRk1UmvdcCgUCYoeH1wAKCRDIRk1Umvdc
|
||||
Cqa9EAC8Li+w/sRwiu39vNUBogWiAKj3mlfS9lEdmPWx/MSzWtik+IlI931flFWI
|
||||
GL3OWC0ZXVV9G3WXQmVUqMtW2Eachy1DOSwAh4nRn03udfeMG79DUJBvMpAKTSua
|
||||
cVr2tRCFXQcx+6hmkZaANGjalzVu8tEcWfOiT19LS1QM+PH36adQCtRD+wwLgvVq
|
||||
qVowo6yO6jdhCATakRWO9uqeQXvdhJ7n5A3/Hg4QKtbb5vbz6QTPOs1+prICBdfF
|
||||
rVEdLx9BeZGVVoWeJNzbv9ZciC+8YYo/HOTbkccJSJ+G/FeHvshYL9Saxrsl1nUX
|
||||
yNCHBdrUyxPfZMgPWD2k431uplUVCwV5MOaQR4KU8AO3lcKVs02viw4smo0mWa6O
|
||||
pnMIHQ/cWgNxB5/66ch3r7YqosBi8KWHMVBejD+tOv/Y1Ey7v0mF7nBdIclbQz8t
|
||||
6PlKN8cOggqWjczPo1BtwPxiAkI8Y4VyhOk4ncZnluY1CtM2rQipLfcVFC/z3UGh
|
||||
ZuZ9WIi31ns8Va+msHyIaQx51PB0hSmL+AkDjUuB5APO9zFE2tGV9elbmant6f5c
|
||||
k4F65i19kDcfPe397FjqgyCdIduEDDtoaSS+a6oUgffHgXMXhtP2hI9zQ6c8Bnnd
|
||||
f10HDxakJEcNEz7m8i7VZ0xb+UsOej2rSgdyTIW+an9t8NF9eIkBMwQQAQgAHRYh
|
||||
BHM4lzBp7T9EP00336ZP1bF62zmoBQJii0M3AAoJEKZP1bF62zmoEZYIAIK8SaCJ
|
||||
KT/0NtCyzmFdjX6v+H+EYjEUJCx1QPsHt35Qglco24L/X9hnPJF9P6MY3S3PDLyd
|
||||
9JsmD+mujgsShqYFME/GzSScYy5Mzm5FM0xXs9UJ51YL+frKknenN5eIr7WVjXnh
|
||||
g0fKn2ZqXlZ/MozHKjKQhhzl9SN6b8eDbi1SFHS/FC7C4Tymnrkhi2KAvpEtUyvg
|
||||
mRSCU5Hrqh6wvi1bCpZ4+vXzQG20CT2cxa1YmgJIDhBqKiWGLyEY2hMCoRKsx5CI
|
||||
UVllc83Hrpk182DDOoVVhxFpStYD/4CNCP46oSeOtjv6EPLIIug25rsjBHPHPfMf
|
||||
p64DcAoKkk6cuFWJAjMEEAEKAB0WIQRB25JxPTv0v/PukQacXn+i9Ul31AUCYoeM
|
||||
ZQAKCRCcXn+i9Ul31EVUD/kB3lxEMDKFg/lFpSBxm1nxplmOCp5Nq9F8Rs9KDsbR
|
||||
Rc4zKL+2PLkgfxh/Nk5+9zjclUjFMBzYS0vEEml7f1R6ceG1a9r7HrdkO581Mvwe
|
||||
x90qVkMMKsShqIcuLzOK0LpvTobBlQpZCBImsNaEVHnmMR3hCz5OmUsGjxNgym87
|
||||
+ovRJKCZRbbJ36w+COf/jVEkczm+7OrG5BeTTPwWjoIkqs6dajYikfZI79J7FZ2C
|
||||
pWpWeIgJA5emc3sAZWi0KTxlPZ9K4ff3iuV+Xf2PyuRC3iZlOuO66RJ/sl441ebN
|
||||
ckn1Ngu3s48PyMjgD3VG8WDh4RCqBtLpMQJc60wboq9gPMhyyd5eyTYMI90HAEg9
|
||||
pYGsw6Wk8NpUmBzbSzqSOOdN/SvAXkJmQVGKEzgvDLEsmTeddsjE6U+KUS+8Y69k
|
||||
Dc3sRIR3p5cKoPgZuK2mgbiXvF+TyVGODsyUUCygCGBNN8vsDDw4gpTuOhUm1nMP
|
||||
3jagHWz2NnMRo00x2nayjffjpMHCKSoNy+UTBKhVLffeZ8df6fCD9SAK+UavPVFW
|
||||
kMKhd+gofhrIbnca9ZL4K+CdyD1d0sxWNtoiDGi9HSnTwXhyGujv2QnNpBxCUZTD
|
||||
nvOEUSNFP/9N+tkAAGiAvk5L5ZuwHRppvnv6t6JEbM7ryRBwWHwgWHConwiFWImN
|
||||
XYkCMwQQAQoAHRYhBC6ZFqS4exJw9J8ez+sX9nTHmkCiBQJii1dOAAoJEOsX9nTH
|
||||
mkCiKu4P/0+je/GsBE69YVAwEFBrrfhEJtVUY8GSYM8WeFoq20SX8SqwltGLFB5R
|
||||
kbZGgPLe0lJrgXzL01GqjU1tnXPbtI7LEq1FKiTkcKVdne140oX1XJuxmFWBcldG
|
||||
1IetinhJt5EkaYc6nyk9iWgCz9n5YDq9Lr/9jLhFQAgawuicwAfuB13MGbJZYm/Z
|
||||
5eSdxnivXbrGAYR2TI6/kcf0JLGR03fKbrEM8uBnfZNkKZELyYrBCj4FYODT++Sx
|
||||
pDyrNr2/FlierISJrs272JT7ICg7Knjh6X7BSzsgK7JxyG2UtJKK7qJXYEqMtYhH
|
||||
U1tdh4Ru6zSd4DklgrFHwuUNlTm8f1gPQ4I46p2RCQy2HMnA9WhJ8kwE2JOAj83y
|
||||
87f9hDwjmn8Pf/iksXGRFQcfDqkOIUf2EnyBvxrzS57Dfvk6WCaH+OLKn1jMyxL8
|
||||
BekCyk7L7wrMJI4yH51jyJySScGBg1CM0fYqLFWU/I+jw9bHROdCOK2LBajkAYgx
|
||||
/eLG9WtS4etlNmpsxhSOi48wxa6kIOnD2rJGvQMALxhWJlVBEOMumv96qNCQCzHd
|
||||
6NRLBWBva4qlKM5RlZreeVyArFtTiUmnp6RST4FrMpVgmhoeyos6P6GIG6QVPS2b
|
||||
4dSRbeKmJFb15kZN8eYP4/BW7DMBzkFwtkRFDV5f/4W6CU6UIGzViQEcBBABCAAG
|
||||
BQJii68XAAoJEFIKmZOhwFL4HY0IAKejouSXBCQWJmpdsA9TV2WVdMspUZHDGRAH
|
||||
epQetm0+eX5Jh62ktuAZG+KCZ0bMdd8FJd6+RRpftUGhDibu9IFfyIK1v8jrChTU
|
||||
/EwK8cPgLn4KveTgC58UrKt4NMpqcETUCrXHVwZzYK/sGZxxKVHhmnQJtfsvg7FV
|
||||
7Ia9ohiUy1/rz9UlwLPUGmrDnSemSR9w1B3XeNN8SmTHQ5gpZt/rvsII0wMhvS7p
|
||||
TXDpK5YNAqItC+7ZDaU1T21xeZx9OGSt/T2ETXb0rjIJAhKiSShqbiRonZHrxOcg
|
||||
p0vSM1IAsgfnRihHu9YZ3Vj5ntegHh4fWdcTSZUx0n/YggArsyG0JEtvbnN0YW50
|
||||
aW4gUGF2bG92IDx0aHJlc2hAbmdpbnguY29tPokB1AQTAQgAPgIbAwULCQgHAwUV
|
||||
CgkICwUWAwIBAAIeAQIXgBYhBBPIKmO2A1dhVuMKTqDqmBtmsNlnBQJihN+8BQkQ
|
||||
+q8XAAoJEKDqmBtmsNlncQ0L/0Yk1QejO06gWwV1J2eK9LmjbMofy2ujZBgW1IGt
|
||||
/goo5R4PzC8lBBcsBtsKyN0Rsh7QdLrtKKLQrE/gpwMTMdKhJTdP/c5tUY3EwgId
|
||||
BMYVaxArZQiWlPgSnoKuKydnn6Rb+Qtrhvb9pjn5XlGd/VSbAXZe8YTj6B8qjUa2
|
||||
YY+IreyB6wkPN/ytV5vcocbS7mzXaibGPVT35e0Pl1Be+xbJkbTmJTSJCSPwyHm9
|
||||
t2Vuq4e/c3fMwhOUbBjfssspR103vo91XO5sY+v2aQJOctNrv4ZpHMrwBH7MeqDI
|
||||
SCWg9PICUv0ewHzAEGB+K0v342rVAzVNEctwM3Jic7fEJYsItdw+Zk4r8NYqACoR
|
||||
CdSUEHqhP0DbYoWdthpUwD1J5ryWyKTCpTL4wNhKEMcNaiHH3qorSssyMHMFRPoX
|
||||
Kw9Pcay+Uo8NXc2KKxhEHTbQts0jYUNcq0yuWHoNQ4vhKkf9CHBrb/vS22vfEJyd
|
||||
6FX6ZRYK56A3EFAV8hK0BvZAw4kCMwQQAQoAHRYhBNZ4bOMD2akCKZjcbMhGTVSa
|
||||
91wKBQJih4fSAAoJEMhGTVSa91wKipoQAI3wkWd8HLQ0w4IFA6W3/igrZTut9sV+
|
||||
K5Veb61zCbJn6I2aO3ldSClMWpJfvG1OPKyaA6o4QfWt7KV9of8tu68k1rTrKKYe
|
||||
qXe/0KNp9nzEwVmLASG2U6onwaCehGocvhWc9tE6MF2Gi+l+OufqsMzmx7gkdwE+
|
||||
4d/VpY/i+eZzqNi1WWNUR45mrItvw84enGW2u4JOaFdSOE2PAbSTUOlcLxfC9yCo
|
||||
lxAkCsy+CsXM8WKlIDH8GpWh/mWyqjoAhZhrlGhdABjygqFAOrDhIaecc8eSOcD3
|
||||
6MQvhj/y1kh0Fe0rMCSdxUWtSjv+Sw5g1IG6GxhsqFxunxfGDpdbaLnyTQWahDfi
|
||||
5OsOFl6JbPFiTaF9Xqz+8r0hiwusT4AJvM5M+q18f5dNCeqVKmuAn3BVBw4RdG62
|
||||
WXt4q6uE5rDI513dR8t84dTgOr9+tHKh5TJqw46aI+kMe36z7FPXBgDsGSkNtM4J
|
||||
BYdZzxSoJCfsGCjlfapkLHrvI+S7AP2952WfYy36uuxBiuTp3vCghvKkXZUeN2kh
|
||||
P++0Zo4OjZGOllhab1X5xZGO8AjWeei4pq66Ys94Veidw5VRi/eWyvB3OhfCq9fb
|
||||
qZIKUfbgTu0y7vOEWWY9wQml12gpxQfkcI72NTiNMCH268WZoXYQJp0+NZtxjsHQ
|
||||
PdhNxQOaJPqziQEzBBABCAAdFiEEcziXMGntP0Q/TTffpk/VsXrbOagFAmKLQzAA
|
||||
CgkQpk/VsXrbOairRggArvsikhDrA1d/x1BXnzOxE2sznq/d84QCKMSQpavrzXHF
|
||||
LQF/qIB+ePA4bmzwvTxQup7yTLK3mQDl0rejXEQMnXHvgfH73c6l6TdAwsoLmrpt
|
||||
oGNzfzJsbiKD2hJT9jJVnipuqqOA7hPT73TA5KM4GzPupFTadB57lDxzzcRfALXi
|
||||
t5Qa6A83tLelQXLOWP6IdyPjraa/kva5jYsMavZU0xWTx9nPeGCwqAnqdEN4Hp8K
|
||||
WKYn9EzkBOL6pPB7GyG/G20ocTCv/ZCJMkamAxjprUovu9BUEg5fCcHrSBtsgGE0
|
||||
doPfqyOb4tCofZ8aXZYIu3+BEcNO0e5la+eW0YYYPIkCMwQQAQoAHRYhBEHbknE9
|
||||
O/S/8+6RBpxef6L1SXfUBQJih4xhAAoJEJxef6L1SXfUb8AQAML5vwKOTw6Bn0tA
|
||||
1ypo6DmlJUWalGgEkFheUC02s+BT+bL/fMsiXd6dBHHl/93bVBQBL/AjVBVv7viQ
|
||||
kfQLLk7iQmEQ/mljvImGkA/W+vyHKDue6n79Ccjfx/ECQB4Y8mmFhOqhDjEC6oR6
|
||||
ny77QbqmzvjkhfncD26cJq+qRGnE7EwuQI49bR1deQGxr5apqx5XRbf+GPnXlPTc
|
||||
nKxctRsw6PLOjFoyGhBnvC/rEzBUx+wE7jK+bY1TSdW8x91LA/SseWqsmEFzbZRt
|
||||
KKaHE9wD2DB9UvdBAjXdBZvKQ35zSJRWQByODztI9ZcaOWopK3UtIhG/eNIaJGcD
|
||||
9h3SaeVE8PcUkvZqhLtQf49KlUBc8/g6Nj1wqcBbHDXjbwzt9Qoh6uFyjMkbG3NP
|
||||
BXn7cT8888fJ9Oi53XjjZEVKA88AdcqWpUZtyElNwGtj8IvJ0R9SMKR/7KIYPFWm
|
||||
R04Uok+oj0wQABHkcLmYMUd8psw6aQWG7oybfgPokRChExigLWrCJbYd00banL18
|
||||
W6RxOQzceiKeZ5sZ5Y+yjQIrKxXKSLl42s8zol05TPScnBn+SAWigG4eEEJhT2by
|
||||
2WqbhCG9snN9/YMlY8MffOFnD05ps40CSdSCsRgcmaqxgjy75h/z5LYO4HnHwPdY
|
||||
p2ysNzlruScewHvijYJhEKxo17lBiQIzBBABCgAdFiEELpkWpLh7EnD0nx7P6xf2
|
||||
dMeaQKIFAmKLV00ACgkQ6xf2dMeaQKLLQg//etbDTflbm+HbxI/YyNQhyQfk7icE
|
||||
ytLL+wT9zDW9iq3AMdaPZwT690CsJhr7yzqjk0AGoMyuPfntvcvYb1mPTObXHMzh
|
||||
Rh7+tViPixkJd3hnjSrPBEOkpAghk6xWMx1wldZ9x5XyJ0yC+toBkSaB/KIQeRG2
|
||||
8/jHtxIQKvPGL28gUjdzW+jopSA4x6gSZAgQLyfsjoUHcMrRJXrwWcmSe8faD8qX
|
||||
XD4z4hN3wQg6olSuaxLM7OoNgbiEjKaL1LaX/xzvC0lGs9o2JBfNFDrng9Y/fZ4o
|
||||
9aGqx7AZey+4wTKjXqbdEqfDiHfzHxkLBunPxSjJAploOcuvhNOQAY7tv19/mYY1
|
||||
UoILY9ninCrXthe9ZqhaXxhRhqYhzrE8svF+R01I/U+N4985AnDKRkJ944pZfeh1
|
||||
wYzEZOPXWvvTsiBLbgi9LuAzoFjA4WJsJBp4AP/U7DtsuhMTmxyBJa+zg8PHj1Ew
|
||||
jBYYuE++ulsilS+76sQawT5KbszpYmEDJiQUuEJkujPQ+hGzuuocoqHrM/IcoAoy
|
||||
i5I/JMAYRqCQfGMFjirmVj3c01jgsOYl7ZgchtCBJfG8V6rlYdTq2FTdaLYdleZC
|
||||
kS7N4jtm+6/KEsf6ukeGNEMbsxTSPHq4RL13eSitRd9Ms+ukSZFFgE0rEiztcdxQ
|
||||
h1PeaEVaxHaSSWiJARwEEAEIAAYFAmKLrxcACgkQUgqZk6HAUvihvAgAk1ETByL3
|
||||
FZtIlk8scREfwzyqyXuSYWdJ5ED61fKnpcfwGKsOkd+4MwHOSgvxPdnLhBEsMkNq
|
||||
sV82EqX7lTIGoFBLTeW8ZGAxmt/88j3z6mnm33lSTreeVwsQ+B9ZKVAv4E/liDVm
|
||||
6iq9aYJni4FUoFjFhtgsvJUNs3oX0gaEXdaCqzIDysU2m01vOPx0HTeI95+HdlJW
|
||||
Iwwh/cp+YuclHppI+b0OQKJwLQDVyudzX0JYTWvgE/NCS6/rP8fjaqtFMWwL0tZl
|
||||
3JJAoLSAuhPyc+V2LkRVoETQGF9nRil2zSyy77Stfm2fRGstnQGOrNTud06el68/
|
||||
hYfWcCqooHNiMrkBjQRa8DInAQwA2Rk7UdUgpCWl+BMz9B9eKj0XtsNEciXHHKnS
|
||||
FYaSNCWNwib/FsiMfcPFh7xwUTof7e7HBFkvv0QEMCEp7R1MVNBfMiGtG1ICFIt9
|
||||
nByznPsRk4VvbY/prK4DZy2AmlwhNcT2pQO3AascgsCWdf6G+wcwnHg9tWCp0Xs9
|
||||
BNXuppmcRrpP4M1PPRIVeG1jeVXvuSHO2HjqPSXP5DhGgSGN7uLOhiLTnPINd186
|
||||
vf6tqRdqYw3g0W1ImEjGXHeNQfnieIWdU3X4C8KTEPsV3lvtmSAQCoge0CyKfz4c
|
||||
ORi4j8Edp8JpDQlbAThe529+R3eKUw7I/3ESxJBdqzLE/ItWvAcbGEserLDFrg9J
|
||||
1ojiKhsw3TVcDk+HIDzVakMz6HTd4ExSijMqTehzgKSVHDL+l2jc0f4VSecI+xwC
|
||||
3/kNsNTBpiPoUYtXBbJllHgQAakREkSKQBas02eqRu8SlQ3yEn87zTtNW8L7xpe7
|
||||
ZVtxwUgp40PUrsb8uMDJG7ZP5rhLABEBAAGJAbwEGAEIACYCGwwWIQQTyCpjtgNX
|
||||
YVbjCk6g6pgbZrDZZwUCYoTfwQUJEPqvGgAKCRCg6pgbZrDZZ3oEDAC1J3BVwlkX
|
||||
+eoo8VsXAYxMXm8kIaTqOn/tHMOYepK+cWUdHaeCH3N8LigwN4Ve2LtzLBqN3WRA
|
||||
xFNy0DIzdBfA7QdcAoDLnB2FNrWTmwvC9nXkCogFfSCq7c+1oFHdn7M/VZNU4o0n
|
||||
hVOnqM8NLGcgzX3K3hr+WLYUgNQ9G6x0N9VU43tqVwJhvNv4pyiRpRdLlmhOEf35
|
||||
a/sWE1dttSKdrBhyzTbptw4dXr4lUpvlswWs+dLpSPPhWAuifORv/amWh3bxIxYE
|
||||
qE4o5NI/PQLJvJJLsJvMIIjpKlAGBJg5h3WCiIAkl7H+BesOUIIg8ava5ZUyjlFd
|
||||
szBMaBosZvRgFAlfnYhSGqzhip6PvXfK1YokNv7kqw43c0f1SmtSXZR43SRv/4vp
|
||||
XG7IqtTuqgSwn1qDJgr4yfs8QQykO/jG+cz7X+5OKSAulWi9OoqLyDWlsm3WccPI
|
||||
cJfbm71P+I/ha7ESVQfOxC92fQ7HQAboj7NhecJ4RLqjzrWSHmPGClI=
|
||||
=t1B0
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
Loading…
Reference in new issue