PL-640 - SSL for NATS.

Summary:
This adds SSL support for NATS. New certificates were needed because of
the NATS CNAME. We bind NATS to boringssl to prevent duplication with openssl.

Test Plan: Deploy on K8s

Reviewers: michelle, oazizi, #engineering

Reviewed By: michelle, #engineering

Differential Revision: https://phab.corp.pixielabs.ai/D978

GitOrigin-RevId: 8c416b2

.arclint

@@ -114,7 +114,11 @@
       ]
     },
     "spelling": {
-      "type": "spelling"
+      "type": "spelling",
+      "exclude": [
+        "(.*\\.crt)",
+        "(.*\\.key)"
+      ]
     },
     "text": {
       "type": "text",

Makefile

@@ -72,12 +72,13 @@ gazelle: gazelle-repos ## Run gazelle to update go build rules.
 go-setup: dep-ensure gazelle
 
 k8s-load-certs:
-	-$(KUBECTL) $(KUBECTL_FLAGS) delete secret proxy-tls-cert
-	-$(KUBECTL) $(KUBECTL_FLAGS) delete secret grpc-tls-cert
-	$(KUBECTL) $(KUBECTL_FLAGS) create secret tls proxy-tls-cert \
+	-$(KUBECTL) $(KUBECTL_FLAGS) delete secret proxy-tls-certs
+	-$(KUBECTL) $(KUBECTL_FLAGS) delete secret service-tls-certs
+
+	$(KUBECTL) $(KUBECTL_FLAGS) create secret tls proxy-tls-certs \
 		--key src/services/certs/server.key \
 		--cert src/services/certs/server.crt
-	$(KUBECTL) $(KUBECTL_FLAGS) create secret generic grpc-tls-cert \
+	$(KUBECTL) $(KUBECTL_FLAGS) create secret generic service-tls-certs \
 		--from-file=server.key=src/services/certs/server.key \
 		--from-file=server.crt=src/services/certs/server.crt \
 		--from-file=ca.crt=src/services/certs/ca.crt \

bazel/repositories.bzl

@@ -130,6 +130,8 @@ def _com_github_nats_io_natsc():
     http_archive(
         name = "com_github_nats_io_natsc",
         build_file_content = BUILD_ALL_CONTENT,
+        patches = ["//third_party:natsc.patch"],
+        patch_args = ["-p1"],
         **location
     )
 
@@ -164,6 +166,7 @@ def _cc_deps():
     _com_github_tencent_rapidjson()
     _com_github_ariafallah_csv_parser()
     _com_github_gperftools_gperftools()
+    _repository_impl(name = "com_google_boringssl")
     _com_github_nats_io_natsc()
     _com_github_cameron314_concurrentqueue()
 
@@ -186,7 +189,7 @@ def pl_deps():
     _repository_impl(name = "com_efficient_libcuckoo", build_file = "@pl//third_party:libcuckoo.BUILD")
     _repository_impl(name = "com_google_farmhash", build_file = "@pl//third_party:farmhash.BUILD")
     _repository_impl(name = "com_github_h2o_picohttpparser", build_file = "@pl//third_party:picohttpparser.BUILD")
-    _repository_impl("rules_foreign_cc")
+    _repository_impl(name = "rules_foreign_cc")
 
     _cc_deps()
     _go_deps()

bazel/repository_locations.bzl

@@ -32,11 +32,20 @@ REPOSITORY_LOCATIONS = dict(
         strip_prefix = "googletest-release-1.8.1",
         urls = ["https://github.com/google/googletest/archive/release-1.8.1.tar.gz"],
     ),
+    # WHEN UPDATING EITHER GRPC OR BORING SSL please make sure that the version of
+    # boringssl matches the version used by GRPC.
+    # TODO(zasgar): Figure out how we can make GRPC using our boringssl as a dep.
     com_github_grpc_grpc = dict(
         sha256 = "50747c8939c535b1059f19534de263eb9b7570b5347390fb24b0bbce8763e9a4",
         strip_prefix = "grpc-1.21.3",
         urls = ["https://github.com/grpc/grpc/archive/v1.21.3.tar.gz"],
     ),
+    com_google_boringssl = dict(
+        sha256 = "2b18e1c1ad15cc180529ababde8a62885ac35005131e9a797cdaf0e07d76a767",
+        strip_prefix = "boringssl-afc30d43eef92979b05776ec0963c9cede5fb80f",
+        urls = ["https://github.com/google/boringssl/" +
+                "archive/afc30d43eef92979b05776ec0963c9cede5fb80f.tar.gz"],
+    ),
     com_github_gflags_gflags = dict(
         sha256 = "9e1a38e2dcbb20bb10891b5a171de2e5da70e0a50fff34dd4b0c2c6d75043909",
         strip_prefix = "gflags-524b83d0264cb9f1b2d134c564ef1aa23f207a41",

scripts/create_gcp_dev_cluster.sh

@@ -139,6 +139,9 @@ if [ ! ${BARE_CLUSTER} = true ]; then
   # TODO(oazizi/philkuz): Fix when we set-up RBAC.
   $PIXIE_ROOT_DIR/scripts/setup_cluster_role_bindings.sh
 
+  # Install default dev secrets and certs.
+  make -C $PIXIE_ROOT_DIR k8s-load-dev-secrets k8s-load-certs
+
   # Deploy Pixie prereqs (NATS, etcd).
   $PIXIE_ROOT_DIR/scripts/deploy_cluster_prereqs.sh
 
@@ -149,10 +152,4 @@ if [ ! ${BARE_CLUSTER} = true ]; then
 
   # TODO(oazizi/philkuz): Enable monitoring through this script.
   # $PIXIE_ROOT_DIR/demos/applications/sockshop/monitoring_manifests/create_monitoring.sh
-
-  # Load certs and secrets for required Pixie agent deployment.
-  pushd $PIXIE_ROOT_DIR > /dev/null
-  make k8s-load-certs
-  make k8s-load-dev-secrets
-  popd > /dev/null
 fi

scripts/setup_dev_k8s.sh

@@ -27,6 +27,8 @@ else
   fi
 fi
 
+make -C ${workspace} k8s-load-dev-secrets k8s-load-certs
+
 ${workspace}/scripts/deploy_cluster_prereqs.sh
 
 echo "K8s cluster setup complete!"

src/common/nats/nats_connector.h

@@ -1,6 +1,6 @@
 #pragma once
 
-#include "third_party/foreign_cc/natsc/include/nats/nats.h"
+#include <nats/nats.h>
 
 #include <chrono>
 #include <memory>
@@ -18,6 +18,12 @@ PL_SUPPRESS_WARNINGS_END()
 namespace pl {
 namespace nats {
 
+struct NATSTLSConfig {
+  std::string ca_cert;
+  std::string tls_key;
+  std::string tls_cert;
+};
+
 /**
  * NATS connector for a single topic.
  * @tparam TMsg message type. Must be a protobuf.
@@ -26,18 +32,42 @@ template <typename TMsg>
 class NATSConnector {
  public:
   NATSConnector(std::string_view nats_server, std::string_view pub_topic,
-                std::string_view sub_topic)
+                std::string_view sub_topic, std::unique_ptr<NATSTLSConfig> tlsConfig)
       : nats_server_(std::string(nats_server)),
         pub_topic_(std::string(pub_topic)),
-        sub_topic_(std::string(sub_topic)) {}
-  virtual ~NATSConnector() {}
+        sub_topic_(std::string(sub_topic)),
+        tls_config_(std::move(tlsConfig)) {}
+  virtual ~NATSConnector() {
+    if (nats_connection_ != nullptr) {
+      natsConnection_Destroy(nats_connection_);
+    }
+
+    if (nats_subscription_ != nullptr) {
+      natsSubscription_Destroy(nats_subscription_);
+    }
+  }
 
   /**
    * Connect to the nats server.
    * @return Status of the connection.
    */
   virtual Status Connect() {
-    auto nats_status = natsConnection_ConnectTo(&nats_connection_, nats_server_.c_str());
+    natsOptions* nats_opts = nullptr;
+    natsOptions_Create(&nats_opts);
+
+    if (tls_config_ != nullptr) {
+      natsOptions_SetSecure(nats_opts, true);
+      natsOptions_LoadCATrustedCertificates(nats_opts, tls_config_->ca_cert.c_str());
+      natsOptions_LoadCertificatesChain(nats_opts, tls_config_->tls_cert.c_str(),
+                                        tls_config_->tls_key.c_str());
+    }
+
+    natsOptions_SetURL(nats_opts, nats_server_.c_str());
+
+    auto nats_status = natsConnection_Connect(&nats_connection_, nats_opts);
+    natsOptions_Destroy(nats_opts);
+    nats_opts = nullptr;
+
     if (nats_status != NATS_OK) {
       return error::Unknown("Failed to connect to NATS, nats_status=$0", nats_status);
     }
@@ -112,6 +142,7 @@ class NATSConnector {
   std::string nats_server_;
   std::string pub_topic_;
   std::string sub_topic_;
+  std::unique_ptr<NATSTLSConfig> tls_config_;
   moodycamel::BlockingConcurrentQueue<std::unique_ptr<TMsg>> incoming_message_queue_;
 };
 

src/services/api/service.skfld.tmpl

@@ -48,7 +48,7 @@ spec:
       volumes:
         - name: certs
           secret:
-            secretName: grpc-tls-cert
+            secretName: service-tls-certs
 ---
 apiVersion: v1
 kind: Service

src/services/certs/ca.crt

@@ -1,29 +1,34 @@
 -----BEGIN CERTIFICATE-----
-MIIFCjCCAvICCQDkaXSdy9IddzANBgkqhkiG9w0BAQsFADBHMQswCQYDVQQGEwJV
-UzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoM
-ClBpeGllIExhYnMwHhcNMTkwNDI0MDQzNjA0WhcNMjAwNDIzMDQzNjA0WjBHMQsw
-CQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28x
-EzARBgNVBAoMClBpeGllIExhYnMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
-AoICAQDW1FcQbkl45EJarQ4pD8Lt/ijrGKg64scxMjhZ+v+IXGCwUAZx0EmUxJEr
-Qyaorrv1BwegVeNCJ5UH2mNV/VM6F+QtvYOvCLIbkJnpCWwDxd5QCsL1P/eppQrM
-uf75Ayrp5l7VnsuqySpn4XsCGcZ7iRJbnBAwU9r7gRec8IOnIY4VgGHpptWYi62l
-kjtjtgdpCN6783lCTjnLxK2pbIx8oYE5ppmd34lZmhkZG+xZk34/zLkZZoKIsqTw
-rLUpf7Y2fJ/7bx+GCrwpoce6kAoFMiYmcq6I9HFOJp/7FH/TjoXt5/XdB8nUw+Tv
-XPSMNJo4u3eM47XbZ5OUGUon5wyNNivjcHtHdeOIqVXwoJhriRG4EsdIU7ibch5E
-QJr2P7qGgh3nKaIKfZss31+e5+vZiXlM7RrPFKbp4YjImU7OBqddJ/mg2IPbZAVb
-03O2f6uTFtclsxzwBpbmxyJvZAU++lDnm924VOp/IHx71AF8GsVN5PEQMjoBWNdS
-ftn7c35zxx6afAM6N1RYf3PUG7yPRGjq51VsVh5Z8w+q/DCcRgBvXWsMhJiZ3K84
-5nXlmUT2Al0BYXB0fY0lmrCJPc+nowYnTPELw1Ed63ZcZUDn5b83o9iwslNykAr0
-xI1D8qJMy9MJ997y2isF2xWTfDoFj2UBR6KnVPk6DAkuvdh3uQIDAQABMA0GCSqG
-SIb3DQEBCwUAA4ICAQCVQthlWYgbVIZFkO3XkegLJYBVGZa1/pddGdIdmBkQbKHr
-KeyD6mpUQnHRk20lptdXCZHpaZ5eT0jZpbuZSh74MVcHj5f//M9Ft1h+N5F/JOad
-HuTNb5z7YJDwC7vJU/IuEdVJHDxxWc3Eht9QrwMotWBKpTnMDro6n8uByZmW3Lp5
-FkWZLvESi2oNtgPAUOqw7bqJzrZCAC7T+v02jSSqM9k20j1TSkQFWxj4R3Ch5G1s
-TrQyi9Ut27nTDQB637QLwGxA1Bj80BULWQ5fm3i4iDA3rTxOaexsHfbPzJgE+HZ8
-hQgMNeZ/rmRoQsEbZvIAys+040gJ3VgEJGoCusJJ60QzxpCQtJXfsCG0v1F9lKgZ
-3RkPlQ7kYrqP5IAjzPeMqBP72FUFz0KTqIERg1y8GFeyR6O5a5mjP/ZuyDSWd1LZ
-4FWGFJocfRUnXTeZa5IcXBWTh+tPpLxOYUF9Pgcq2r0JWn+BV+M3zD3wJu9kbs2/
-GHUuYqKrsxAEMdWHIYARu3cjW9Eak88w+0vp829nfPoA6G9UMN5FHC12N5sppMIC
-psnqzk22sZp3m4ckzXhvqYuZ4YfCHmcVqqqoFnJ4b16p+L4wZVoTYWOtubacEgZ5
-UOM1mAW346Vq1CcQJsJlBQoLNI0qfjet7kwfr8WWiQndjVMLV2VRbFJAizpFFA==
+MIIF7jCCA9agAwIBAgIJAJ3NKuzBf+5QMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYD
+VQQGEwJVUzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xGDAW
+BgNVBAoMD1BpeGllIExhYnMgSW5jLjEZMBcGA1UEAwwQd3d3LnBpeGllbGFicy5h
+aTEiMCAGCSqGSIb3DQEJARYTemFzZ2FyQHBpeGllbGFicy5haTAeFw0xOTA2MTMx
+ODQ5MTFaFw0yMDA2MTIxODQ5MTFaMIGLMQswCQYDVQQGEwJVUzELMAkGA1UECAwC
+Q0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xGDAWBgNVBAoMD1BpeGllIExhYnMg
+SW5jLjEZMBcGA1UEAwwQd3d3LnBpeGllbGFicy5haTEiMCAGCSqGSIb3DQEJARYT
+emFzZ2FyQHBpeGllbGFicy5haTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
+ggIBANMipoa3SaZURZEaLwrsGLPyEO5q3GIwyHZ8q9J2SVpWDqxYYF+iJpOLZzyb
+3Jux9DXiTsRD7PTvaAvON6FH+qs7U2Oewj1Dr7AyptYk0Lh3oAQ0LRnX6wIeiK2A
+cyRSFRiavCwoo/0tS13ROMQaXAFvVcMzptVSVva56sst3ucuM53Gvl6Ie+crcETC
+G83Ilv4JOl4CteCe4r81wQiQakEZxeVMHLAJQHctwzN2ntcEIw8QmJER5kKd7XSK
+ohUuGT/bZjd8LuQP3dSBMrupp49fdzZYK7i3arFvoowgghEingyWKixI02CH2KQf
+Cqf/gOxhAlxIPklouu+jU40NrXA0gkfU4U1jMxD5uae+kT2OYR1KiG7c9YHgk/EU
+7PXtLNPSKcbR0W4kyvBncgmWscNL0ZzWwivxna+AVZcAZABzyv8auvWnhxL0hPIN
+lOKKJ4XFrcuBFC9E3XAb6Fas4mtZS0HqrLojPjYMwGgvqU8Q70LbsVlWBlDo21Ld
+LIcYF9Tad3lx0gfb2CufNB61uuQEDgNN9ijSyXQSVITW9cUcCiaP01SYIxgrtKBU
+jdm9IreteysJPM6WawDKT98OOTLquga+HQS3dClHq7gQ24rLFjRdkdpWDreiOB3i
+XCUO4hMhV/yw5tTskSlBMLf8OS4H4pl6Ps7un2od8yYBEGtRAgMBAAGjUzBRMB0G
+A1UdDgQWBBQchQwk/aXCBlRPEqcJLncTanVzsjAfBgNVHSMEGDAWgBQchQwk/aXC
+BlRPEqcJLncTanVzsjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IC
+AQBW08se/OHvERTG/+Jm6UCrN8Vj4BJk1lOm4rvWm14qffUcLLCsTQpdhBXLgpto
+w7/9IKO9zud5t74kS/eB676H52GMtFnDUrFTHiCoD5B88KhIaZmvX0oCPH2LUFq8
+hAUssvOQ05Zs0h6pVCEgMK4+T/e3K9vfsJZWAhBRwkesKB4m+MK4SgHNs1b+qOsK
+EPbjwFdtCRzxyMVpPo/akxD0TV7/ZBzx9nWiKd1NiE8bwZcXR0SoYJzGKCgpLtfa
+GM4kWnI3MN1fhRGEjPI+3VuwccHgk/RvmvXZCOc085kDEMZrWyLuygVTzE45D8GP
++rJyRbv0UPqGM0lLQ6/MX6Qv9gWChmB7m9ZL5cvCuuX2VWdoksECv0JfeXQqwgHg
+yIUSsQEcocItg+NEvvF/sDHG/9h6qxGohOkCg1oRw84mW6ocmLhqc4DHY2ht9+tH
+s7N0PRNn9Bqz/4dP2hZQm+7DpzCwbNN3Uf6Oot6aW0XgwJ1KLH+FGrWwOa78dYBR
+Ve77fZQblVSz47D41EM0sqnAtP/Mj6drY4/Guuu29xakO5ajvvQakT5d3zrEMYcS
+4NrzgSYC/798UO96yBMSLrIhaHz9fvUfIiKiQJtwsHhLyNVGSXROyHFqeY1Mv/6X
+Zy6ubWQJ3V6+Lf8qOaML1kMjww53VCm68NbStUSf70Sr/w==
 -----END CERTIFICATE-----

src/services/certs/ca.key

@@ -1,54 +1,54 @@
 -----BEGIN RSA PRIVATE KEY-----
 Proc-Type: 4,ENCRYPTED
-DEK-Info: DES-EDE3-CBC,8AA634F966EF5F19
+DEK-Info: DES-EDE3-CBC,2C887D9CC28B6DFD
 
-Mqur1dM0V+352hV2a4wQxO+0w3MGvT4bFR61PYOG2EPAHtSisSmIPU6mO5ChkVpT
-VvP9bKlG1mgltr3ehuZUjYwOKDAA5xtD7EiYLJJgPymWdOhhDG2BXVi9bSwIeEz2
-BCDbjkpZvE83ut7ZWB1hcV5aG7nrRh7ZtqwJn7HqvIAwS2g1OQrEjzq1DojmWd0d
-tv7SFEYsHwe0DRkVcqL4NN2fPiTEDrbnaL17aFbR/9pwhphal21Di5W3msPbkBDS
-FaV5qYXk7d36T/1wlFFxfwOuTPDap4ouv3Kgx+y5xseNgsFQhe/GWp/l/CPP/2YL
-vmvxOVUr6eVJV6HsdNTWQ9H+c9WkMKyQdNnFTrFsXt1k0g2g9uN+wbMI5VRg+a6o
-N6Zswze95bGUCrM7xjgFIb+FOW9A/b/+6cSE9Up91ABHa2AtXLHfFfRQFt5qxkk/
-HUIU3u6mfk/DlXUNvlXUWIZdVvk2XoMRjqtzZPDYjUhhC5y8Mz2OmKVDWb9Z3dJi
-CmGSThCFv6Bf0Pte97WXIW5UcGyuCDxlHjXid+ECq5GYm/Y4wzQFuzquBlWHpuCl
-xBVvLVW25+zw+KfBiUu4rJU5mQFTiCgREUrFxWA0xdoIkkDT+Zl0R0TIZR2aPykH
-m8g+G4W+yfV68JHBbEcAcqUO8Hzsv+/nABJRAGAoHtAkwekzjMqcQ7vw4DbCmbc/
-3nyNo2vL7TJknTIoEunbEFRiyHoaVugkBVDBJCG8FSytOFY/n8WdsyqhHo4w3myf
-jbfkxcnt3WxKuSH1P/zCrm73aA4f5kaYSdmHI9LoOHhtkNOGU7L/caW0m92Tyfrf
-576D4nThDEErbQhFpt3hPe3m/D8QxB9u/KYSSQzoJHSCE+8YD3W4VKm5JcR+Jg4s
-Uf2K1By2024flN0mSYTKFPQg4+IMM4QoJP6PWdfl6uHcwMW8ULgzWg8Vtg2bKBec
-oZVGvMkKZ3ayh31ixsDQ0bPGkFpU2DlxEojahvZX/vKMXkjVGzLrmawLJjbfKx/w
-0yRJCj37gs6uMY+iFmFZtLx3tqEQfKoH3k3BKaUSKnYYuD9q3t1CXAIv352bZ1an
-5CRF70njUZXq53mTrl0sLrsd3SreBDqsl3BoEQuRHUIr4JXIYIkFkaCp4aV66DUG
-KhB+iyZWcyt76KjDOHnOej9h0MRQo6fz+7XWSAKLlmhYZldvuxWiudOc2+JZAMPZ
-QuDiOaaxvyHkLQRlKpF1WQqPMTXCzcM3ZPwud1nVhVGNhjE4h0hMaV9ptMob+As6
-0B131aIYht4pIDU3jWmGBCnNf24X/JbRMM6Lt9F29YwZjU2CFlpxvhQiYfWr9oNy
-to5YBmEvRp4yOIoeY54arDGosoLDyxKQN2mDPbhi/fui0p7TW7Zpma0H1RDyOTO8
-1Cq83JqUPMdOnrkZ7urqXfLwYhwVfyf7xzMngHpwWOujwWSBycrGzmeBdY0F2AHe
-XJJG0RjGp2PdQOesXCRDMqxSJhy9GI56aRCn1685M12HRJkkycTGS5gSOm3N0zfT
-DbMqNr8nlFNK7K5R/0mtqykrMSdHJ32IpJbo7FlEkM9rlcFMygku9y9omtf9lQ4e
-cTWRq0vSknOb+H9qtud5CvQurjOh3CMWYxPfSiyNXjutTFhUpGMWsNltn3Yl2YNd
-xnCgsgQjP9ZWIL6gvmuvANODUhchljWiLAUSdZ/eD5C+bNOUSfNjuB7x7v8RhbQs
-nV2DKJDEyAY6zboobO6MYD+hmdPD2PlPjzEJZBuLsMR6f/QbS6EuJIs51BHJI4hw
-/n/DmYpGXgLS05TJ06hpUl0mvAFsYxkC6S9wwlXUTRMQ7qV/Wc/u5HGwxW5mINnr
-jTbnMlxtXXU73L2QCqqwUTGZETmsftzh7CVIzZs2MHhiLoJYgYP4K9JhIb3Qovql
-OZbyYDk2b9+8RSZGBTfC8GKfILQQExGkN+vlxoF9fzl8WXx6UqMqU5/rMchesivm
-Hnt2zBIoELXnRUsv/Uu+cgQBpKbS2F/uFSZhgqy06LhNmnXr4eE2yifarWEw+Krg
-BhhKZg0pwxJEggVvArwgLpgsnAxBQsDZEF15RERtxKJ8SFt8idhzstavb+SfC2ti
-SxrilsUIO/mvVkfql2Zt/BvurL0av2QnbmAmpOnlmD44BFwRXXkqxqN7Xwy8I0eA
-0Cu+/sL9dx0rsKs0TxnBzu0nfS0BYd6oTP1zaoQvxMxVDNC3caVzmuR9rqEaLzSF
-N7myHwxsO9az7c8llN8q0CTlY7V5rO0gRtjeD4WDgl5AwT7LfPv/q9r8SXzo4S5l
-icLY57vC1yBY+WzIEct+Irp+ZTft3PIrc06ophtlAUIUcVnS4PhdBeKgbS+dqih9
-jZij/nm8jX/FINuU2WAzQypYogCK1N7AfZF50z31fT+MxaltY5E72Zl73ix+JSNj
-mPbvqsxCtI3eT9Yb2WgDV7dqPS9uPhOdSYb06rXMwYwYid+oHRA1bPIcVK988obu
-CXDjT43i3GjQ2W+g2SZRJvCg9+IC6b18qkJxQ4MGNCT4wVOrcW/YRh5sHS3Bjd+f
-WcKbCyzG8LdAli22FYz+IGPWhUqULgPLYneh7Nh80NFv64tyW0TdJKcVgIXGG0j4
-SVoV08HK+KrlomRTjoz659PZfOGGe0IojiHSgQ2WGX9Ar+loP5rxd7jSSlctLpEx
-mvj9pI1y+AtiK+hheF0qJfkn1/GpS2Ht3zyzSXOjdpdanvgEfwtw2ejea9MoXipB
-1YN32/YsslNXRAVLeBWg+ZWoiC91bzQOu6beXKhxnBRdjtoLoOnolZf3/nFVgwI3
-CY5gJ21hNpRqvbGMR1J+71UxUD5dG/tbPBAuIMhKrn5KXl+g9Rb9axiFlPeKjK0x
-O4NGS3TUhr2j3hyAz2SVDH7WDnwLd4RMZ29pYs8ZLU2VkCSmlbz7ULhTteXDSWt+
-g4DKQXIv8seMAkcghmAu0kDIuscTahcI+x82bf+GrKdcISNWKD8cePO+5BmUbi2u
-P/mG66FJPWaFiYGsqNScJD0Ym9BNjC/rAbObPzvH7bQCtm9vMIr4Jb6dQBxT6VpE
-QbjbKqH8LesLpVzZ4Quh7sjoJjEmjSsRh3Lm/fCWx2Z7rtkMjEEvatc62Twx1B0M
+MTJW1HzN3LdutedlGv898a5VR+iVIBC0epYN30nZHaFYytmts76UwK/MSIacQeQa
+xCGz1vPuxieo9JDVP9ky6a6D+DskmWDi4vBhjSEBqe+aRBgI8OE1V31JsagquwfK
+xAXoWQL3Q6ChHmu+pWVmB2K6rAZXIlidnZJRTow7tzxk/8MhD+RyhVF0RD6nbQTR
+BvTvyLkcFTAvVOtHYd0s4PsX1JiSDvTkJoCOqASllLMBFTIRT39MRcMTe99cVK7Y
+FZMq6UF9uQ0w5XK0NLMhHSoPNIkiACYnFvP05d0Vh5nmiUMUYADt4VUiTloVBaLA
+OEysrtvdZP7RQIlRGUVZpVbkAUqn+nKUZn1JEGqtGNFVKaJqmUMRFHZV5pTp6bzb
+6fU3r9N5cy57T1VU/sLFNXCagjmnod/TjJz+QntUlI2706bGtxf2CB8h9zZMdxIo
+QrtIylkJtHOPAjVdOpaDTKE4ELfBV5puqLLrOQlnrYKmyWBsl0lZj4+HT4nbEADz
+GOJPCJchI31dnMprNkCZMCJdPB0xYUJoWJGILrBKRR5UwSdfllcmt97AJk7zsCnv
+nNwA0gRLPSI+l5p21eY4+/eJBpb9n8vxnKGMylVkftHBUbafKTgX/Q/r4hqdbE1t
+VheQZb3lnJ9l7/qX2iOLmayMCxFWGUcDJEZkrwOBtKiLmLON2n2yrRQehLhGySgF
+kJngas7alUUyJgaEwI3TEagRgpqPDdhP3ZlEv+4OPQ9YjI7k6cLb4pVvw/NS9omG
+lB3yFb7spTKehZ1ihD1SxPlo0aWkOWbTKO09+9V5S3MexcNs5WkkJoijI9qd0Umn
+EktLkVwDZEJCoSO8FwCA+YA4ab4eWJRSTBsM7KisSd/L870uJFh0A597phcBQxJ3
+gRFFk1sWkVAyMDfMSz0UH53vFi3kAUN1YUXfrKVjMJsXs8/FXuV+Hgj+blQE9jm2
+t8JlQNqkTI8ZrsenAu3oKfogK4Lh+pR+3Yr7OqcJg5BDj4M3KsvWSwpLWkLws0j3
+0uapPdnFZCXcg9LoBHxKeoxN9UGaOmiS/1TynXYs4kVUEwm9MfC3lkPSkfQouyo9
+p2xQmkK9uEo5hMxnarbgKtkZ0EISduD0dHGNOB9gP/UMielSodDXSRbc5Wx44N+X
+hB9jb6a8Ws3m8B5nxFG2D23q8xPZfzQ7cMatidGlsrzFGwPXlnn2TxarEuW3/imH
+dWU5v2mZddikFMiyp8+ISZt9cK0DLj6xO1aTVxhIkyYPw/OFbUjJKWT6E8G4PxS7
+T7NimglSS1acFIRMf+BAZ3wM85TTmnTPgzvF7+weQmOLVuzt74JBHoIq8Cr3ahfJ
+vZ+DUOvF55pJifhFqPc3RzK4jCRiwNjouzdp7ie370n2LmgwrBm7sOmPJMRdcUmg
+NvDyb2eZYNg8SkYLT2Wl+DlAQFur6do3Oh7v9X8kYlyHBAQb82joX2xZAPrjPx2X
+dtM1jfyy9iyjY361fmk87b6OpONIUrXZprNqSrshnIe5TUInLBMyli2aPDA6ba7T
+8SmFkeXAsvfqd6TOWheK4bltkktAWRdmAM6d/i9Jo2PgLN1OJIqtZy1p+7a89niS
+gg1XpKoKP0JS2oLVsUgPFgfIEfiRl7gaUhIkKFtK86d9Sdl01TMM8ZYmsVYrBGPf
+vA2FQk+PUQeqA7KhxeM4PWHG6q9FdNpStPjkqb7WZteOUmm92N18FDLiJvecfCZt
+Nf7UzMdvTG7tsGY0ANAHNgQE2w4hAcylH2UWwjkLkfG8dZyCjwamMmWVeRoPG/iQ
+Xh3YUnTWigkdD15KWRLwNYalbJOsC4kIGy6PIZC1BAjPqI6gpLYGYmHtmzoK19m6
+5x+j9Gfh5eZLzHAbJOLu3JrWWCOa99Pd+SDFKvwZuZB5DmqMbOB58S55NAyuwPJG
+SRx7cDOsZC9G91QYeCXYnM26+CD9+l2bsPfiN/G9e4DhK+vSmsrK5fEmCgnQCYxe
+a8XA3Vs/kyczwW1YW5qF/j85WSgLYVHpJ4oSe1nxEfJAUO+zj5Y9h8RfE8LDwKlZ
+cqw1FweQD2FXD6j4WT7fZfltd2V1EMw59/3BRbloH+DAUu84Rd5nKqBOj69CYozO
+m1MVgA78HBHIxqEyHVS8IgC/rPPdTuS99tmUULQl/ip2YapfZoh9UcWaOULmy65l
+U4LIoEeVG6iEMDvuACi01NYih5Un0tw0NlN/Y5pcLumESoUlsD8tB+JGsDB6j+3N
+u7diyZ95YbYAq5TtHfyG+5uVBc2fXq9pryzk+JEFwWYpprtQ2qcN+jjaUTp9Ookv
+0ueIFxU0pbykOXIOMY0J1AdV0Ts/psgWWyhwqv8pvQLQCxG7Q5pbqV0IT+t/FK/m
+IrTePhc00ILfvc/91KevKWjy9MqMESCn2R3vVQxqgppgroR1zUS1syuLyAf7DGf6
+UHRQbpkPU+P049mWYeUfrc4VqKnqrwq22roT/zM1BryP1P/7wFm6ZaZimPNEllvw
+ebA5dzaIOhrLRAJDCOBFxWs6PujnWPSRkBiemPBZ9F4+wZ6Jcylw4PpnRM/DLPVx
+LJ+rMYRx3Sa1/zA4lgpOyJKY0+WFXAwWm/Qk4Bkcb7V9ziM/EFCTZz/92fjsHj8T
+ckHos4jPB8LyYO6MioZZFcHKrF4dDOe5zbyC/EkIhKRjw/+gUepp4d2kPNdWlb20
+CDGDscr68hP75xG5vDH/uewZ4I5reqzpnWK4R9mvSFIranGEo8aBmUWTtE5tqwYV
+nqAv0pCS8Q/kyItU0QABho4/4gzffZVkWjfDdh6VJHBClqFA+O4JFypD5upCkOFs
+mT2FZRKPD8aZTmgBJK8FmZbMRRfRPY0lySyGrowb0ePBqEFm1LoYp5rCPvioignD
++0sAW6K8mgMKuX5LfXbqFC0QqcQXpEPssKHVP10Fav6wDB2LnP2iBANxLsVuYI99
+h4rqYB2EOaiTCbdRcvLqsKmLHeNI6dG5aW7bMjyQgvhAiJgp13IxFXg+s/9oWTZ3
+8CV7q1xkYgwxLgEAmZOiDGM41T35jEnEl4U59N4mypja5N0Az+zKiW2iND5bL1JI
+87G6ZzIbHNiQnwkVA76FHhF40wAudPBq1WxpjkTSJgPgs2KHdks25lgrZ72gaMR+
 -----END RSA PRIVATE KEY-----