From k.thimmaraju@informatik.hu-berlin.de Thu Nov 12 08:34:12 2020 Return-Path: X-Original-To: quic@ietfa.amsl.com Delivered-To: quic@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B6593A13F3 for ; Thu, 12 Nov 2020 08:34:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.988 X-Spam-Level: X-Spam-Status: No, score=-1.988 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=informatik.hu-berlin.de Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7_4G29RWQg0A for ; Thu, 12 Nov 2020 08:34:09 -0800 (PST) Received: from mailout1.informatik.hu-berlin.de (mailout1.informatik.hu-berlin.de [141.20.20.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86A3B3A1216 for ; Thu, 12 Nov 2020 08:34:08 -0800 (PST) Received: from mailbox.informatik.hu-berlin.de (mailbox [141.20.20.63]) by mail.informatik.hu-berlin.de (8.15.1/8.15.1/INF-2.0-MA-SOLARIS-2.10-25) with ESMTPS id 0ACGY5k5021496 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 12 Nov 2020 17:34:06 +0100 (MET) Received: from hashkash-imac.local (dslb-178-012-027-180.178.012.pools.vodafone-ip.de [178.12.27.180]) (authenticated bits=0) by mailbox.informatik.hu-berlin.de (8.15.1/8.15.1/INF-2.0-MA-SOLARIS-2.10-AUTH-26-465-587) with ESMTPSA id 0ACGY4pP021490 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NO); Thu, 12 Nov 2020 17:34:04 +0100 (MET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=informatik.hu-berlin.de; s=mailbox; t=1605198845; bh=65o8tSAam6YKY9S7hY0yMcfuRV6pP8L+MY/dPH5/ZyI=; h=To:From:Subject:Cc:Date; b=D24t8jzen2Rs/i7oYalXW0ugruNQx5e1guNcpma9V6+CHiTw4TY4VADTRwCCWYxCu FXYpQLHPrb6jvFVdAM4zSJn8PCrCClRxOLMzKXMHqT8eaX57laGf6C/x1PKwcvufbJ /VI3DCkNjfi5/qFssmdOT9RwyNI/Wncu/qBvnPLI= To: quic@ietf.org From: Kashyap Thimmaraju Subject: [New Issue] CID based attacks Cc: =?UTF-8?Q?Bj=c3=b6rn_Scheuermann?= Message-ID: Date: Thu, 12 Nov 2020 17:34:03 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.4.3 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------4007C3168DED685A03FEC6F6" Content-Language: en-US X-Virus-Scanned: clamav-milter 0.102.3 at mailbox X-Virus-Status: Clean X-Greylist: Sender succeeded STARTTLS authentication, not delayed by milter-greylist-4.6.1 (mail.informatik.hu-berlin.de [141.20.20.50]); Thu, 12 Nov 2020 17:34:06 +0100 (MET) Archived-At: X-Mailman-Approved-At: Thu, 12 Nov 2020 09:00:40 -0800 X-BeenThere: quic@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Main mailing list of the IETF QUIC working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Nov 2020 16:44:01 -0000 This is a multi-part message in MIME format. --------------4007C3168DED685A03FEC6F6 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit ** *Dear QUIC WG,* * I’m Kashyap Thimmaraju, a postdoctoral researcher at Humboldt University Berlin. Recently I discovered a couple of attacks with the QUIC protocol. Lars Eggert recommended that I share my findings with the WG to discuss the impact and relevance of these findings. Broadly speaking, the attacks deal with the Connection ID (CID), which I’ve elaborated on below. ANALYSIS The draft specifies and recommends several important points on secure usage of the CID, e.g., i) the same CID MUST NOT be used multiple times over the same connection to prevent an eavesdropper from correlating the end-points; ii) end-points should associate a sequence number with each CID to detect reuse within the same connection; iii) CIDs should be (pseudo) randomly generated as they are also used for packet security and; iv) CIDs can be very long (max. 20 bytes). The draft, however, does not specify how servers should handle the case when successive incoming connections to a server use the same destination CID.  Indeed, it can be seen that  based on the assumption that the CIDs are (pseudo) randomly generated with a maximum length of 20 bytes, the probability of such a collision is very low. Hence, I posit the following: If the server (implementation) does not permit the use of the same destination CID across successive connections (for a specific timeout), then an attacker can exploit this behaviour in at least 2 ways: 1. She can enumerate the number of server instancesbehind the domain name/public IP address: if the handshake does not complete on the second/successive attempt, then she infers that she has reached the same instance; if the handshake succeeds then it is a new instance. 2. Create a covert channel: we can assume that a sender and receiver agree upon a set of CIDs to use at specific times. For each time interval, the sender and receiver use the same destination CID. The sender sends a 1 by connecting to the server and a 0 by not connecting. The receiver always attempts to connect to the server. If the receiver could not complete the handshake, it’s a 1, if the handshake completes it’s a 0. Using this scheme a binary string can be covertly communicated in one direction. EVALUATION The primary goal of my evaluation is to identify implementations, if any, that prevent two subsequent QUIC connections from using the same destination CID. To conduct this experiment I adopted the following methodology. First, I created a client that uses deterministic CIDs for the source and destination CIDs (I modified LiteSpeed Technologies open-source QUIC client). Second, I used 15 implementations from those listed on the QUIC Working Group’s GitHub page1: either manually built Docker containers or the public test server. The list of servers tested are shown across the two rows in Table 1. To conduct the experiment, I had the client open and hold a QUIC connection with source CID 1 and destination CID 2 for a maximum of 10s with the server, and then close it. We then idle for 10s and repeat the steps a second time. I saved the debug logs of the client, packet traces and session keys. I then repeated the process for each of the 15 implementations. Finally, to obtain the results of the test, I searched the debug log of the client or the packet trace to confirm whether the second QUIC connection obtained a successful handshake or not. The absence of a successful handshake indicates a vulnerable implementation. RESULTS The results from my evaluation are shown in the table below. In particular, I found 4 out of 15 implementations to be vulnerable to the enumeration and covert channel attacks, namely, Apache Traffic Server (ATS), Chromium, LiteSpeed and NGTCP2. In an evaluation of the throughput using Lsquic clients and server on my desktop I measured a throughput of ~30 bps. VULNERABLE : IMPLEMENTATION NO : Akamai, F5, Quinn, Aioquic, Quiche, Proxygen, Neqo, Nginx, Picoquic, Quant, Quicly YES : ATS, Chromium, Lsquic, Ngctcp2 * Sincerely, -- Dr.-Ing Kashyap Thimmaraju Lehrstuhl für Technische Informatik Institut für Informatik Humboldt-Universität zu Berlin Besucheranschrift: Rudower Chaussee 25, 12489 Berlin Haus 4, 3. OG k.thimmaraju@informatik.hu-berlin.de http://www.ti.informatik.hu-berlin.de --------------4007C3168DED685A03FEC6F6 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 PGh0bWw+CiAgPGhlYWQ+CgogICAgPG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBj b250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRGLTgiPgogIDwvaGVhZD4KICA8Ym9keT4K ICAgIDxwPjxiIGlkPSJkb2NzLWludGVybmFsLWd1aWQtODEzNjBkNzEtN2ZmZi05ZWQ1LTNi ODgtZjFiZTAzM2NjYzkzIgogICAgICAgIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDAsIDAs IDApOyBjb2xvcjogcmdiKDAsIDAsIDApOwogICAgICAgIGZvbnQtc3R5bGU6IG5vcm1hbDsg Zm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6CiAgICAgICAgbm9y bWFsOyBvcnBoYW5zOiBhdXRvOyB0ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6IDBw eDsKICAgICAgICB0ZXh0LXRyYW5zZm9ybTogbm9uZTsgd2hpdGUtc3BhY2U6IG5vcm1hbDsg d2lkb3dzOiBhdXRvOwogICAgICAgIHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQt c2l6ZS1hZGp1c3Q6IGF1dG87CiAgICAgICAgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDog MHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7CiAgICAgICAgZm9udC13ZWlnaHQ6IG5vcm1h bDsiPgogICAgICAgIDxwIGRpcj0ibHRyIiBzdHlsZT0ibGluZS1oZWlnaHQ6IDEuMzg7IG1h cmdpbi10b3A6IDBwdDsKICAgICAgICAgIG1hcmdpbi1ib3R0b206IDBwdDsiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBBcmlhbDsgY29sb3I6IHJnYigw LCAwLCAwKTsgYmFja2dyb3VuZC1jb2xvcjogdHJhbnNwYXJlbnQ7IGZvbnQtd2VpZ2h0OiA0 MDA7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50LWxpZ2F0dXJlczogbm9ybWFs OyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXZhcmlhbnQtZWFzdC1hc2lhbjog bm9ybWFsOyBmb250LXZhcmlhbnQtcG9zaXRpb246IG5vcm1hbDsgdGV4dC1kZWNvcmF0aW9u OiBub25lOyB2ZXJ0aWNhbC1hbGlnbjogYmFzZWxpbmU7IHdoaXRlLXNwYWNlOiBwcmUtd3Jh cDsiPkRlYXIgUVVJQyBXRyw8L3NwYW4+PC9wPgogICAgICAgIDxicj4KICAgICAgICA8cCBk aXI9Imx0ciIgc3R5bGU9ImxpbmUtaGVpZ2h0OiAxLjM4OyBtYXJnaW4tdG9wOiAwcHQ7CiAg ICAgICAgICBtYXJnaW4tYm90dG9tOiAwcHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAx MXB0OyBmb250LWZhbWlseTogQXJpYWw7IGNvbG9yOiByZ2IoMCwgMCwgMCk7IGJhY2tncm91 bmQtY29sb3I6IHRyYW5zcGFyZW50OyBmb250LXdlaWdodDogNDAwOyBmb250LXN0eWxlOiBu b3JtYWw7IGZvbnQtdmFyaWFudC1saWdhdHVyZXM6IG5vcm1hbDsgZm9udC12YXJpYW50LWNh cHM6IG5vcm1hbDsgZm9udC12YXJpYW50LWVhc3QtYXNpYW46IG5vcm1hbDsgZm9udC12YXJp YW50LXBvc2l0aW9uOiBub3JtYWw7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgdmVydGljYWwt YWxpZ246IGJhc2VsaW5lOyB3aGl0ZS1zcGFjZTogcHJlLXdyYXA7Ij5J4oCZbSBLYXNoeWFw IFRoaW1tYXJhanUsIGEgcG9zdGRvY3RvcmFsIHJlc2VhcmNoZXIgYXQgSHVtYm9sZHQgVW5p dmVyc2l0eSBCZXJsaW4uIFJlY2VudGx5IEkgZGlzY292ZXJlZCBhIGNvdXBsZSBvZiBhdHRh Y2tzIHdpdGggdGhlIFFVSUMgcHJvdG9jb2wuIExhcnMgRWdnZXJ0IHJlY29tbWVuZGVkIHRo YXQgSSBzaGFyZSBteSBmaW5kaW5ncyB3aXRoIHRoZSBXRyB0byBkaXNjdXNzIHRoZSBpbXBh Y3QgYW5kIHJlbGV2YW5jZSBvZiB0aGVzZSBmaW5kaW5ncy48L3NwYW4+PC9wPgogICAgICAg IDxicj4KICAgICAgICA8cCBkaXI9Imx0ciIgc3R5bGU9ImxpbmUtaGVpZ2h0OiAxLjM4OyBt YXJnaW4tdG9wOiAwcHQ7CiAgICAgICAgICBtYXJnaW4tYm90dG9tOiAwcHQ7Ij48c3BhbiBz dHlsZT0iZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQXJpYWw7IGNvbG9yOiByZ2Io MCwgMCwgMCk7IGJhY2tncm91bmQtY29sb3I6IHRyYW5zcGFyZW50OyBmb250LXdlaWdodDog NDAwOyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFudC1saWdhdHVyZXM6IG5vcm1h bDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC12YXJpYW50LWVhc3QtYXNpYW46 IG5vcm1hbDsgZm9udC12YXJpYW50LXBvc2l0aW9uOiBub3JtYWw7IHRleHQtZGVjb3JhdGlv bjogbm9uZTsgdmVydGljYWwtYWxpZ246IGJhc2VsaW5lOyB3aGl0ZS1zcGFjZTogcHJlLXdy YXA7Ij5Ccm9hZGx5IHNwZWFraW5nLCB0aGUgYXR0YWNrcyBkZWFsIHdpdGggdGhlIENvbm5l Y3Rpb24gSUQgKENJRCksIHdoaWNoIEnigJl2ZSBlbGFib3JhdGVkIG9uIGJlbG93Ljwvc3Bh bj48L3A+CiAgICAgICAgPGJyPgogICAgICAgIDxwIGRpcj0ibHRyIiBzdHlsZT0ibGluZS1o ZWlnaHQ6IDEuMzg7IG1hcmdpbi10b3A6IDBwdDsKICAgICAgICAgIG1hcmdpbi1ib3R0b206 IDBwdDsiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBBcmlh bDsgY29sb3I6IHJnYigwLCAwLCAwKTsgYmFja2dyb3VuZC1jb2xvcjogdHJhbnNwYXJlbnQ7 IGZvbnQtd2VpZ2h0OiA3MDA7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50LWxp Z2F0dXJlczogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXZhcmlh bnQtZWFzdC1hc2lhbjogbm9ybWFsOyBmb250LXZhcmlhbnQtcG9zaXRpb246IG5vcm1hbDsg dGV4dC1kZWNvcmF0aW9uOiBub25lOyB2ZXJ0aWNhbC1hbGlnbjogYmFzZWxpbmU7IHdoaXRl LXNwYWNlOiBwcmUtd3JhcDsiPkFOQUxZU0lTPC9zcGFuPjwvcD4KICAgICAgICA8cCBkaXI9 Imx0ciIgc3R5bGU9ImxpbmUtaGVpZ2h0OiAxLjM4OyBtYXJnaW4tdG9wOiAwcHQ7CiAgICAg ICAgICBtYXJnaW4tYm90dG9tOiAwcHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMXB0 OyBmb250LWZhbWlseTogQXJpYWw7IGNvbG9yOiByZ2IoMCwgMCwgMCk7IGJhY2tncm91bmQt Y29sb3I6IHRyYW5zcGFyZW50OyBmb250LXdlaWdodDogNDAwOyBmb250LXN0eWxlOiBub3Jt YWw7IGZvbnQtdmFyaWFudC1saWdhdHVyZXM6IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6 IG5vcm1hbDsgZm9udC12YXJpYW50LWVhc3QtYXNpYW46IG5vcm1hbDsgZm9udC12YXJpYW50 LXBvc2l0aW9uOiBub3JtYWw7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgdmVydGljYWwtYWxp Z246IGJhc2VsaW5lOyB3aGl0ZS1zcGFjZTogcHJlLXdyYXA7Ij5UaGUgZHJhZnQgc3BlY2lm aWVzIGFuZCByZWNvbW1lbmRzIHNldmVyYWwgaW1wb3J0YW50IHBvaW50cyBvbiBzZWN1cmUg dXNhZ2Ugb2YgdGhlIENJRCwgZS5nLiwgaSkgdGhlIHNhbWUgQ0lEIE1VU1QgTk9UIGJlIHVz ZWQgbXVsdGlwbGUgdGltZXMgb3ZlciB0aGUgc2FtZSBjb25uZWN0aW9uIHRvIHByZXZlbnQg YW4gZWF2ZXNkcm9wcGVyIGZyb20gY29ycmVsYXRpbmcgdGhlIGVuZC1wb2ludHM7IGlpKSBl bmQtcG9pbnRzIHNob3VsZCBhc3NvY2lhdGUgYSBzZXF1ZW5jZSBudW1iZXIgd2l0aCBlYWNo IENJRCB0byBkZXRlY3QgcmV1c2Ugd2l0aGluIHRoZSBzYW1lIGNvbm5lY3Rpb247IGlpaSkg Q0lEcyBzaG91bGQgYmUgKHBzZXVkbykgcmFuZG9tbHkgZ2VuZXJhdGVkIGFzIHRoZXkgYXJl IGFsc28gdXNlZCBmb3IgcGFja2V0IHNlY3VyaXR5IGFuZDsgaXYpIENJRHMgY2FuIGJlIHZl cnkgbG9uZyAobWF4LiAyMCBieXRlcykuPC9zcGFuPjwvcD4KICAgICAgICA8YnI+CiAgICAg ICAgPHAgZGlyPSJsdHIiIHN0eWxlPSJsaW5lLWhlaWdodDogMS4zODsgbWFyZ2luLXRvcDog MHB0OwogICAgICAgICAgbWFyZ2luLWJvdHRvbTogMHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IEFyaWFsOyBjb2xvcjogcmdiKDAsIDAsIDApOyBi YWNrZ3JvdW5kLWNvbG9yOiB0cmFuc3BhcmVudDsgZm9udC13ZWlnaHQ6IDQwMDsgZm9udC1z dHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtbGlnYXR1cmVzOiBub3JtYWw7IGZvbnQtdmFy aWFudC1jYXBzOiBub3JtYWw7IGZvbnQtdmFyaWFudC1lYXN0LWFzaWFuOiBub3JtYWw7IGZv bnQtdmFyaWFudC1wb3NpdGlvbjogbm9ybWFsOyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGlu ZTsgdGV4dC1kZWNvcmF0aW9uLXNraXA6IG5vbmU7IHZlcnRpY2FsLWFsaWduOiBiYXNlbGlu ZTsgd2hpdGUtc3BhY2U6IHByZS13cmFwOyI+VGhlIGRyYWZ0LCBob3dldmVyLCBkb2VzIG5v dCBzcGVjaWZ5IGhvdyBzZXJ2ZXJzIHNob3VsZCBoYW5kbGUgdGhlIGNhc2Ugd2hlbiBzdWNj ZXNzaXZlIGluY29taW5nIGNvbm5lY3Rpb25zIHRvIGEgc2VydmVyIHVzZSB0aGUgc2FtZSBk ZXN0aW5hdGlvbiBDSUQ8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTFwdDsgZm9u dC1mYW1pbHk6IEFyaWFsOyBjb2xvcjogcmdiKDAsIDAsIDApOyBiYWNrZ3JvdW5kLWNvbG9y OiB0cmFuc3BhcmVudDsgZm9udC13ZWlnaHQ6IDQwMDsgZm9udC1zdHlsZTogbm9ybWFsOyBm b250LXZhcmlhbnQtbGlnYXR1cmVzOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3Jt YWw7IGZvbnQtdmFyaWFudC1lYXN0LWFzaWFuOiBub3JtYWw7IGZvbnQtdmFyaWFudC1wb3Np dGlvbjogbm9ybWFsOyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IHZlcnRpY2FsLWFsaWduOiBi YXNlbGluZTsgd2hpdGUtc3BhY2U6IHByZS13cmFwOyI+LsKgIEluZGVlZCwgaXQgY2FuIGJl IHNlZW4gdGhhdMKgIGJhc2VkIG9uIHRoZSBhc3N1bXB0aW9uIHRoYXQgdGhlIENJRHMgYXJl IChwc2V1ZG8pIHJhbmRvbWx5IGdlbmVyYXRlZCB3aXRoIGEgbWF4aW11bSBsZW5ndGggb2Yg MjAgYnl0ZXMsIHRoZSBwcm9iYWJpbGl0eSBvZiBzdWNoIGEgY29sbGlzaW9uIGlzIHZlcnkg bG93Ljwvc3Bhbj48L3A+CiAgICAgICAgPGJyPgogICAgICAgIDxwIGRpcj0ibHRyIiBzdHls ZT0ibGluZS1oZWlnaHQ6IDEuMzg7IG1hcmdpbi10b3A6IDBwdDsKICAgICAgICAgIG1hcmdp bi1ib3R0b206IDBwdDsiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6IDExcHQ7IGZvbnQtZmFt aWx5OiBBcmlhbDsgY29sb3I6IHJnYigwLCAwLCAwKTsgYmFja2dyb3VuZC1jb2xvcjogdHJh bnNwYXJlbnQ7IGZvbnQtd2VpZ2h0OiA0MDA7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12 YXJpYW50LWxpZ2F0dXJlczogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBm b250LXZhcmlhbnQtZWFzdC1hc2lhbjogbm9ybWFsOyBmb250LXZhcmlhbnQtcG9zaXRpb246 IG5vcm1hbDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyB2ZXJ0aWNhbC1hbGlnbjogYmFzZWxp bmU7IHdoaXRlLXNwYWNlOiBwcmUtd3JhcDsiPkhlbmNlLCBJIHBvc2l0IHRoZSBmb2xsb3dp bmc6IDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTog QXJpYWw7IGNvbG9yOiByZ2IoMCwgMCwgMCk7IGJhY2tncm91bmQtY29sb3I6IHRyYW5zcGFy ZW50OyBmb250LXdlaWdodDogNDAwOyBmb250LXN0eWxlOiBpdGFsaWM7IGZvbnQtdmFyaWFu dC1saWdhdHVyZXM6IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC12 YXJpYW50LWVhc3QtYXNpYW46IG5vcm1hbDsgZm9udC12YXJpYW50LXBvc2l0aW9uOiBub3Jt YWw7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgdmVydGljYWwtYWxpZ246IGJhc2VsaW5lOyB3 aGl0ZS1zcGFjZTogcHJlLXdyYXA7Ij5JZiB0aGUgc2VydmVyIChpbXBsZW1lbnRhdGlvbikg ZG9lcyBub3QgcGVybWl0IHRoZSB1c2Ugb2YgdGhlIHNhbWUgZGVzdGluYXRpb24gQ0lEIGFj cm9zcyBzdWNjZXNzaXZlIGNvbm5lY3Rpb25zIChmb3IgYSBzcGVjaWZpYyB0aW1lb3V0KSwg dGhlbiBhbiBhdHRhY2tlciBjYW4gZXhwbG9pdCB0aGlzIGJlaGF2aW91ciBpbiBhdCBsZWFz dCAyIHdheXM8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1p bHk6IEFyaWFsOyBjb2xvcjogcmdiKDAsIDAsIDApOyBiYWNrZ3JvdW5kLWNvbG9yOiB0cmFu c3BhcmVudDsgZm9udC13ZWlnaHQ6IDQwMDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZh cmlhbnQtbGlnYXR1cmVzOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7IGZv bnQtdmFyaWFudC1lYXN0LWFzaWFuOiBub3JtYWw7IGZvbnQtdmFyaWFudC1wb3NpdGlvbjog bm9ybWFsOyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IHZlcnRpY2FsLWFsaWduOiBiYXNlbGlu ZTsgd2hpdGUtc3BhY2U6IHByZS13cmFwOyI+Ojwvc3Bhbj48L3A+CiAgICAgICAgPG9sIHN0 eWxlPSJtYXJnaW4tdG9wOiAwcHg7IG1hcmdpbi1ib3R0b206IDBweDsiPgogICAgICAgICAg PGxpIGRpcj0ibHRyIiBzdHlsZT0ibGlzdC1zdHlsZS10eXBlOiBkZWNpbWFsOyBmb250LXNp emU6IDExcHQ7IGZvbnQtZmFtaWx5OiBBcmlhbDsgY29sb3I6IHJnYigwLCAwLCAwKTsgYmFj a2dyb3VuZC1jb2xvcjogdHJhbnNwYXJlbnQ7IGZvbnQtd2VpZ2h0OiA0MDA7IGZvbnQtc3R5 bGU6IG5vcm1hbDsgZm9udC12YXJpYW50LWxpZ2F0dXJlczogbm9ybWFsOyBmb250LXZhcmlh bnQtY2Fwczogbm9ybWFsOyBmb250LXZhcmlhbnQtZWFzdC1hc2lhbjogbm9ybWFsOyBmb250 LXZhcmlhbnQtcG9zaXRpb246IG5vcm1hbDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyB2ZXJ0 aWNhbC1hbGlnbjogYmFzZWxpbmU7IHdoaXRlLXNwYWNlOiBwcmU7Ij48cCBkaXI9Imx0ciIg cm9sZT0icHJlc2VudGF0aW9uIiBzdHlsZT0ibGluZS1oZWlnaHQ6IDEuMzg7IG1hcmdpbi10 b3A6IDBwdDsgbWFyZ2luLWJvdHRvbTogMHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTog MTFwdDsgZm9udC1mYW1pbHk6IEFyaWFsOyBjb2xvcjogcmdiKDAsIDAsIDApOyBiYWNrZ3Jv dW5kLWNvbG9yOiB0cmFuc3BhcmVudDsgZm9udC13ZWlnaHQ6IDQwMDsgZm9udC1zdHlsZTog bm9ybWFsOyBmb250LXZhcmlhbnQtbGlnYXR1cmVzOiBub3JtYWw7IGZvbnQtdmFyaWFudC1j YXBzOiBub3JtYWw7IGZvbnQtdmFyaWFudC1lYXN0LWFzaWFuOiBub3JtYWw7IGZvbnQtdmFy aWFudC1wb3NpdGlvbjogbm9ybWFsOyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IHZlcnRpY2Fs LWFsaWduOiBiYXNlbGluZTsgd2hpdGUtc3BhY2U6IHByZS13cmFwOyI+U2hlIGNhbiA8L3Nw YW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IEFyaWFsOyBj b2xvcjogcmdiKDAsIDAsIDApOyBiYWNrZ3JvdW5kLWNvbG9yOiB0cmFuc3BhcmVudDsgZm9u dC13ZWlnaHQ6IDQwMDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtbGlnYXR1 cmVzOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7IGZvbnQtdmFyaWFudC1l YXN0LWFzaWFuOiBub3JtYWw7IGZvbnQtdmFyaWFudC1wb3NpdGlvbjogbm9ybWFsOyB0ZXh0 LWRlY29yYXRpb246IHVuZGVybGluZTsgdGV4dC1kZWNvcmF0aW9uLXNraXA6IG5vbmU7IHZl cnRpY2FsLWFsaWduOiBiYXNlbGluZTsgd2hpdGUtc3BhY2U6IHByZS13cmFwOyI+ZW51bWVy YXRlIHRoZSBudW1iZXIgb2Ygc2VydmVyIGluc3RhbmNlczwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQXJpYWw7IGNvbG9yOiByZ2IoMCwgMCwg MCk7IGJhY2tncm91bmQtY29sb3I6IHRyYW5zcGFyZW50OyBmb250LXdlaWdodDogNDAwOyBm b250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFudC1saWdhdHVyZXM6IG5vcm1hbDsgZm9u dC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC12YXJpYW50LWVhc3QtYXNpYW46IG5vcm1h bDsgZm9udC12YXJpYW50LXBvc2l0aW9uOiBub3JtYWw7IHRleHQtZGVjb3JhdGlvbjogbm9u ZTsgdmVydGljYWwtYWxpZ246IGJhc2VsaW5lOyB3aGl0ZS1zcGFjZTogcHJlLXdyYXA7Ij4g YmVoaW5kIHRoZSBkb21haW4gbmFtZS9wdWJsaWMgSVAgYWRkcmVzczogaWYgdGhlIGhhbmRz aGFrZSBkb2VzIG5vdCBjb21wbGV0ZSBvbiB0aGUgc2Vjb25kL3N1Y2Nlc3NpdmUgYXR0ZW1w dCwgdGhlbiBzaGUgaW5mZXJzIHRoYXQgc2hlIGhhcyByZWFjaGVkIHRoZSBzYW1lIGluc3Rh bmNlOyBpZiB0aGUgaGFuZHNoYWtlIHN1Y2NlZWRzIHRoZW4gaXQgaXMgYSBuZXcgaW5zdGFu Y2UuPC9zcGFuPjwvcD48L2xpPgogICAgICAgICAgPGxpIGRpcj0ibHRyIiBzdHlsZT0ibGlz dC1zdHlsZS10eXBlOiBkZWNpbWFsOyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBB cmlhbDsgY29sb3I6IHJnYigwLCAwLCAwKTsgYmFja2dyb3VuZC1jb2xvcjogdHJhbnNwYXJl bnQ7IGZvbnQtd2VpZ2h0OiA0MDA7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50 LWxpZ2F0dXJlczogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXZh cmlhbnQtZWFzdC1hc2lhbjogbm9ybWFsOyBmb250LXZhcmlhbnQtcG9zaXRpb246IG5vcm1h bDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyB2ZXJ0aWNhbC1hbGlnbjogYmFzZWxpbmU7IHdo aXRlLXNwYWNlOiBwcmU7Ij48cCBkaXI9Imx0ciIgcm9sZT0icHJlc2VudGF0aW9uIiBzdHls ZT0ibGluZS1oZWlnaHQ6IDEuMzg7IG1hcmdpbi10b3A6IDBwdDsgbWFyZ2luLWJvdHRvbTog MHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IEFyaWFs OyBjb2xvcjogcmdiKDAsIDAsIDApOyBiYWNrZ3JvdW5kLWNvbG9yOiB0cmFuc3BhcmVudDsg Zm9udC13ZWlnaHQ6IDQwMDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtbGln YXR1cmVzOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7IGZvbnQtdmFyaWFu dC1lYXN0LWFzaWFuOiBub3JtYWw7IGZvbnQtdmFyaWFudC1wb3NpdGlvbjogbm9ybWFsOyB0 ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsgdGV4dC1kZWNvcmF0aW9uLXNraXA6IG5vbmU7 IHZlcnRpY2FsLWFsaWduOiBiYXNlbGluZTsgd2hpdGUtc3BhY2U6IHByZS13cmFwOyI+Q3Jl YXRlIGEgY292ZXJ0IGNoYW5uZWw8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTFw dDsgZm9udC1mYW1pbHk6IEFyaWFsOyBjb2xvcjogcmdiKDAsIDAsIDApOyBiYWNrZ3JvdW5k LWNvbG9yOiB0cmFuc3BhcmVudDsgZm9udC13ZWlnaHQ6IDQwMDsgZm9udC1zdHlsZTogbm9y bWFsOyBmb250LXZhcmlhbnQtbGlnYXR1cmVzOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBz OiBub3JtYWw7IGZvbnQtdmFyaWFudC1lYXN0LWFzaWFuOiBub3JtYWw7IGZvbnQtdmFyaWFu dC1wb3NpdGlvbjogbm9ybWFsOyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IHZlcnRpY2FsLWFs aWduOiBiYXNlbGluZTsgd2hpdGUtc3BhY2U6IHByZS13cmFwOyI+OiB3ZSBjYW4gYXNzdW1l IHRoYXQgYSBzZW5kZXIgYW5kIHJlY2VpdmVyIGFncmVlIHVwb24gYSBzZXQgb2YgQ0lEcyB0 byB1c2UgYXQgc3BlY2lmaWMgdGltZXMuIEZvciBlYWNoIHRpbWUgaW50ZXJ2YWwsIHRoZSBz ZW5kZXIgYW5kIHJlY2VpdmVyIHVzZSB0aGUgc2FtZSBkZXN0aW5hdGlvbiBDSUQuIFRoZSBz ZW5kZXIgc2VuZHMgYSAxIGJ5IGNvbm5lY3RpbmcgdG8gdGhlIHNlcnZlciBhbmQgYSAwIGJ5 IG5vdCBjb25uZWN0aW5nLiBUaGUgcmVjZWl2ZXIgYWx3YXlzIGF0dGVtcHRzIHRvIGNvbm5l Y3QgdG8gdGhlIHNlcnZlci4gSWYgdGhlIHJlY2VpdmVyIGNvdWxkIG5vdCBjb21wbGV0ZSB0 aGUgaGFuZHNoYWtlLCBpdOKAmXMgYSAxLCBpZiB0aGUgaGFuZHNoYWtlIGNvbXBsZXRlcyBp dOKAmXMgYSAwLiBVc2luZyB0aGlzIHNjaGVtZSBhIGJpbmFyeSBzdHJpbmcgY2FuIGJlIGNv dmVydGx5IGNvbW11bmljYXRlZCBpbiBvbmUgZGlyZWN0aW9uLjwvc3Bhbj48L3A+PC9saT4K ICAgICAgICA8L29sPgogICAgICAgIDxicj4KICAgICAgICA8cCBkaXI9Imx0ciIgc3R5bGU9 ImxpbmUtaGVpZ2h0OiAxLjM4OyBtYXJnaW4tdG9wOiAwcHQ7CiAgICAgICAgICBtYXJnaW4t Ym90dG9tOiAwcHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWls eTogQXJpYWw7IGNvbG9yOiByZ2IoMCwgMCwgMCk7IGJhY2tncm91bmQtY29sb3I6IHRyYW5z cGFyZW50OyBmb250LXdlaWdodDogNzAwOyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFy aWFudC1saWdhdHVyZXM6IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9u dC12YXJpYW50LWVhc3QtYXNpYW46IG5vcm1hbDsgZm9udC12YXJpYW50LXBvc2l0aW9uOiBu b3JtYWw7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgdmVydGljYWwtYWxpZ246IGJhc2VsaW5l OyB3aGl0ZS1zcGFjZTogcHJlLXdyYXA7Ij5FVkFMVUFUSU9OPC9zcGFuPjwvcD4KICAgICAg ICA8cCBkaXI9Imx0ciIgc3R5bGU9ImxpbmUtaGVpZ2h0OiAxLjM4OyBtYXJnaW4tdG9wOiAw cHQ7CiAgICAgICAgICBtYXJnaW4tYm90dG9tOiAwcHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1z aXplOiAxMXB0OyBmb250LWZhbWlseTogQXJpYWw7IGNvbG9yOiByZ2IoMCwgMCwgMCk7IGJh Y2tncm91bmQtY29sb3I6IHRyYW5zcGFyZW50OyBmb250LXdlaWdodDogNDAwOyBmb250LXN0 eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFudC1saWdhdHVyZXM6IG5vcm1hbDsgZm9udC12YXJp YW50LWNhcHM6IG5vcm1hbDsgZm9udC12YXJpYW50LWVhc3QtYXNpYW46IG5vcm1hbDsgZm9u dC12YXJpYW50LXBvc2l0aW9uOiBub3JtYWw7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgdmVy dGljYWwtYWxpZ246IGJhc2VsaW5lOyB3aGl0ZS1zcGFjZTogcHJlLXdyYXA7Ij5UaGUgcHJp bWFyeSBnb2FsIG9mIG15IGV2YWx1YXRpb24gaXMgdG8gaWRlbnRpZnkgaW1wbGVtZW50YXRp b25zLCBpZiBhbnksIHRoYXQgcHJldmVudCB0d28gc3Vic2VxdWVudCBRVUlDIGNvbm5lY3Rp b25zIGZyb20gdXNpbmcgdGhlIHNhbWUgZGVzdGluYXRpb24gQ0lELiBUbyBjb25kdWN0IHRo aXMgZXhwZXJpbWVudCBJIGFkb3B0ZWQgdGhlIGZvbGxvd2luZyBtZXRob2RvbG9neS4gRmly c3QsIEkgY3JlYXRlZCBhIGNsaWVudCB0aGF0IHVzZXMgZGV0ZXJtaW5pc3RpYyBDSURzIGZv ciB0aGUgc291cmNlIGFuZCBkZXN0aW5hdGlvbiBDSURzIChJIG1vZGlmaWVkIExpdGVTcGVl ZCBUZWNobm9sb2dpZXMgb3Blbi1zb3VyY2UgUVVJQyBjbGllbnQpLiBTZWNvbmQsIEkgdXNl ZCAxNSBpbXBsZW1lbnRhdGlvbnMgZnJvbSB0aG9zZSBsaXN0ZWQgb24gdGhlIFFVSUMgV29y a2luZyBHcm91cOKAmXMgR2l0SHViIHBhZ2UxOiBlaXRoZXIgbWFudWFsbHkgYnVpbHQgRG9j a2VyIGNvbnRhaW5lcnMgb3IgdGhlIHB1YmxpYyB0ZXN0IHNlcnZlci4gVGhlIGxpc3Qgb2Yg c2VydmVycyB0ZXN0ZWQgYXJlIHNob3duIGFjcm9zcyB0aGUgdHdvIHJvd3MgaW4gVGFibGUg MS4gVG8gY29uZHVjdCB0aGUgZXhwZXJpbWVudCwgSSBoYWQgdGhlIGNsaWVudCBvcGVuIGFu ZCBob2xkIGEgUVVJQyBjb25uZWN0aW9uIHdpdGggc291cmNlIENJRCAxIGFuZCBkZXN0aW5h dGlvbiBDSUQgMiBmb3IgYSBtYXhpbXVtIG9mIDEwcyB3aXRoIHRoZSBzZXJ2ZXIsIGFuZCB0 aGVuIGNsb3NlIGl0LiBXZSB0aGVuIGlkbGUgZm9yIDEwcyBhbmQgcmVwZWF0IHRoZSBzdGVw cyBhIHNlY29uZCB0aW1lLiBJIHNhdmVkIHRoZSBkZWJ1ZyBsb2dzIG9mIHRoZSBjbGllbnQs IHBhY2tldCB0cmFjZXMgYW5kIHNlc3Npb24ga2V5cy4gSSB0aGVuIHJlcGVhdGVkIHRoZSBw cm9jZXNzIGZvciBlYWNoIG9mIHRoZSAxNSBpbXBsZW1lbnRhdGlvbnMuIEZpbmFsbHksIHRv IG9idGFpbiB0aGUgcmVzdWx0cyBvZiB0aGUgdGVzdCwgSSBzZWFyY2hlZCB0aGUgZGVidWcg bG9nIG9mIHRoZSBjbGllbnQgb3IgdGhlIHBhY2tldCB0cmFjZSB0byBjb25maXJtIHdoZXRo ZXIgdGhlIHNlY29uZCBRVUlDIGNvbm5lY3Rpb24gb2J0YWluZWQgYSBzdWNjZXNzZnVsIGhh bmRzaGFrZSBvciBub3QuIFRoZSBhYnNlbmNlIG9mIGEgc3VjY2Vzc2Z1bCBoYW5kc2hha2Ug aW5kaWNhdGVzIGEgdnVsbmVyYWJsZSBpbXBsZW1lbnRhdGlvbi48L3NwYW4+PC9wPgogICAg ICAgIDxicj4KICAgICAgICA8cCBkaXI9Imx0ciIgc3R5bGU9ImxpbmUtaGVpZ2h0OiAxLjM4 OyBtYXJnaW4tdG9wOiAwcHQ7CiAgICAgICAgICBtYXJnaW4tYm90dG9tOiAwcHQ7Ij48c3Bh biBzdHlsZT0iZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQXJpYWw7IGNvbG9yOiBy Z2IoMCwgMCwgMCk7IGJhY2tncm91bmQtY29sb3I6IHRyYW5zcGFyZW50OyBmb250LXdlaWdo dDogNzAwOyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFudC1saWdhdHVyZXM6IG5v cm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC12YXJpYW50LWVhc3QtYXNp YW46IG5vcm1hbDsgZm9udC12YXJpYW50LXBvc2l0aW9uOiBub3JtYWw7IHRleHQtZGVjb3Jh dGlvbjogbm9uZTsgdmVydGljYWwtYWxpZ246IGJhc2VsaW5lOyB3aGl0ZS1zcGFjZTogcHJl LXdyYXA7Ij5SRVNVTFRTPC9zcGFuPjwvcD4KICAgICAgICA8cCBkaXI9Imx0ciIgc3R5bGU9 ImxpbmUtaGVpZ2h0OiAxLjM4OyBtYXJnaW4tdG9wOiAwcHQ7CiAgICAgICAgICBtYXJnaW4t Ym90dG9tOiAwcHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWls eTogQXJpYWw7IGNvbG9yOiByZ2IoMCwgMCwgMCk7IGJhY2tncm91bmQtY29sb3I6IHRyYW5z cGFyZW50OyBmb250LXdlaWdodDogNDAwOyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFy aWFudC1saWdhdHVyZXM6IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9u dC12YXJpYW50LWVhc3QtYXNpYW46IG5vcm1hbDsgZm9udC12YXJpYW50LXBvc2l0aW9uOiBu b3JtYWw7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgdmVydGljYWwtYWxpZ246IGJhc2VsaW5l OyB3aGl0ZS1zcGFjZTogcHJlLXdyYXA7Ij5UaGUgcmVzdWx0cyBmcm9tIG15IGV2YWx1YXRp b24gYXJlIHNob3duIGluIHRoZSB0YWJsZSBiZWxvdy4gSW4gcGFydGljdWxhciwgSSBmb3Vu ZCA0IG91dCBvZiAxNSBpbXBsZW1lbnRhdGlvbnMgdG8gYmUgdnVsbmVyYWJsZSB0byB0aGUg ZW51bWVyYXRpb24gYW5kIGNvdmVydCBjaGFubmVsIGF0dGFja3MsIG5hbWVseSwgQXBhY2hl IFRyYWZmaWMgU2VydmVyIChBVFMpLCBDaHJvbWl1bSwgTGl0ZVNwZWVkIGFuZCBOR1RDUDIu IEluIGFuIGV2YWx1YXRpb24gb2YgdGhlIHRocm91Z2hwdXQgdXNpbmcgTHNxdWljIGNsaWVu dHMgYW5kIHNlcnZlciBvbiBteSBkZXNrdG9wIEkgbWVhc3VyZWQgYSB0aHJvdWdocHV0IG9m IH4zMCBicHMuPC9zcGFuPjwvcD4KICAgICAgICA8YnI+CiAgICAgICAgPHAgZGlyPSJsdHIi IHN0eWxlPSJsaW5lLWhlaWdodDogMS4zODsgbWFyZ2luLXRvcDogMHB0OwogICAgICAgICAg bWFyZ2luLWJvdHRvbTogMHB0OyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTogMTFwdDsgZm9u dC1mYW1pbHk6IEFyaWFsOyBjb2xvcjogcmdiKDAsIDAsIDApOyBiYWNrZ3JvdW5kLWNvbG9y OiB0cmFuc3BhcmVudDsgZm9udC13ZWlnaHQ6IDcwMDsgZm9udC1zdHlsZTogbm9ybWFsOyBm b250LXZhcmlhbnQtbGlnYXR1cmVzOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3Jt YWw7IGZvbnQtdmFyaWFudC1lYXN0LWFzaWFuOiBub3JtYWw7IGZvbnQtdmFyaWFudC1wb3Np dGlvbjogbm9ybWFsOyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IHZlcnRpY2FsLWFsaWduOiBi YXNlbGluZTsgd2hpdGUtc3BhY2U6IHByZS13cmFwOyI+VlVMTkVSQUJMRSA6IElNUExFTUVO VEFUSU9OPC9zcGFuPjwvcD4KICAgICAgICA8cCBkaXI9Imx0ciIgc3R5bGU9ImxpbmUtaGVp Z2h0OiAxLjM4OyBtYXJnaW4tdG9wOiAwcHQ7CiAgICAgICAgICBtYXJnaW4tYm90dG9tOiAw cHQ7Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQXJpYWw7 IGNvbG9yOiByZ2IoMCwgMCwgMCk7IGJhY2tncm91bmQtY29sb3I6IHRyYW5zcGFyZW50OyBm b250LXdlaWdodDogNDAwOyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFudC1saWdh dHVyZXM6IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC12YXJpYW50 LWVhc3QtYXNpYW46IG5vcm1hbDsgZm9udC12YXJpYW50LXBvc2l0aW9uOiBub3JtYWw7IHRl eHQtZGVjb3JhdGlvbjogbm9uZTsgdmVydGljYWwtYWxpZ246IGJhc2VsaW5lOyB3aGl0ZS1z cGFjZTogcHJlLXdyYXA7Ij5OTyA6IEFrYW1haSwgRjUsIFF1aW5uLCBBaW9xdWljLCBRdWlj aGUsIFByb3h5Z2VuLCBOZXFvLCBOZ2lueCwgUGljb3F1aWMsIFF1YW50LCBRdWljbHnCoDwv c3Bhbj48L3A+CiAgICAgICAgPHAgZGlyPSJsdHIiIHN0eWxlPSJsaW5lLWhlaWdodDogMS4z ODsgbWFyZ2luLXRvcDogMHB0OwogICAgICAgICAgbWFyZ2luLWJvdHRvbTogMHB0OyI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IEFyaWFsOyBjb2xvcjog cmdiKDAsIDAsIDApOyBiYWNrZ3JvdW5kLWNvbG9yOiB0cmFuc3BhcmVudDsgZm9udC13ZWln aHQ6IDQwMDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtbGlnYXR1cmVzOiBu b3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7IGZvbnQtdmFyaWFudC1lYXN0LWFz aWFuOiBub3JtYWw7IGZvbnQtdmFyaWFudC1wb3NpdGlvbjogbm9ybWFsOyB0ZXh0LWRlY29y YXRpb246IG5vbmU7IHZlcnRpY2FsLWFsaWduOiBiYXNlbGluZTsgd2hpdGUtc3BhY2U6IHBy ZS13cmFwOyI+WUVTIDogQVRTLCBDaHJvbWl1bSwgTHNxdWljLCBOZ2N0Y3AyPC9zcGFuPjwv cD4KICAgICAgPC9iPjxiciBjbGFzcz0iQXBwbGUtaW50ZXJjaGFuZ2UtbmV3bGluZSIgc3R5 bGU9ImNhcmV0LWNvbG9yOgogICAgICAgIHJnYigwLCAwLCAwKTsgY29sb3I6IHJnYigwLCAw LCAwKTsgZm9udC1zdHlsZTogbm9ybWFsOwogICAgICAgIGZvbnQtdmFyaWFudC1jYXBzOiBu b3JtYWw7IGZvbnQtd2VpZ2h0OiBub3JtYWw7IGxldHRlci1zcGFjaW5nOgogICAgICAgIG5v cm1hbDsgb3JwaGFuczogYXV0bzsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAw cHg7CiAgICAgICAgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7 IHdpZG93czogYXV0bzsKICAgICAgICB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0 LXNpemUtYWRqdXN0OiBhdXRvOwogICAgICAgIC13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6 IDBweDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyI+CiAgICAgIFNpbmNlcmVseSw8YnI+CiAg ICA8L3A+CiAgICA8cHJlIGNsYXNzPSJtb3otc2lnbmF0dXJlIiBjb2xzPSI3MiI+LS0gCkRy Li1JbmcgS2FzaHlhcCBUaGltbWFyYWp1CgpMZWhyc3R1aGwgZsO8ciBUZWNobmlzY2hlIElu Zm9ybWF0aWsKSW5zdGl0dXQgZsO8ciBJbmZvcm1hdGlrCkh1bWJvbGR0LVVuaXZlcnNpdMOk dCB6dSBCZXJsaW4KCkJlc3VjaGVyYW5zY2hyaWZ0OgpSdWRvd2VyIENoYXVzc2VlIDI1LCAx MjQ4OSBCZXJsaW4KSGF1cyA0LCAzLiBPRwoKPGEgY2xhc3M9Im1vei10eHQtbGluay1hYmJy ZXZpYXRlZCIgaHJlZj0ibWFpbHRvOmsudGhpbW1hcmFqdUBpbmZvcm1hdGlrLmh1LWJlcmxp bi5kZSI+ay50aGltbWFyYWp1QGluZm9ybWF0aWsuaHUtYmVybGluLmRlPC9hPgoKPGEgY2xh c3M9Im1vei10eHQtbGluay1mcmVldGV4dCIgaHJlZj0iaHR0cDovL3d3dy50aS5pbmZvcm1h dGlrLmh1LWJlcmxpbi5kZSI+aHR0cDovL3d3dy50aS5pbmZvcm1hdGlrLmh1LWJlcmxpbi5k ZTwvYT48L3ByZT4KICA8L2JvZHk+CjwvaHRtbD4K --------------4007C3168DED685A03FEC6F6--