summaryrefslogtreecommitdiffstats
path: root/apps
AgeCommit message (Collapse)Author
14 daysapps: add missing entry to tls extension label listFdaSilvaYY
noticed by @sftcd Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25111)
2024-08-15apps/cms.c, apps/smime.c: Fix -crlfeol help messagesAndreas Treichel
CLA: trivial Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24434) (cherry picked from commit 0813ffee2fe6d1a4fe4ec04b7b18fe91cc74a34c)
2024-08-01Free fetched digest in show_digestsMarc Brooks
Fixes #24892 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25046) (cherry picked from commit 871c534d39efecc2087da0fd24ff72e2712031a4)
2024-07-31Avoid leaking *ba_ret on reconnectionsTomas Mraz
Also fixes Coverity 1604639 There is no point in checking ba_ret as it can never be NULL. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24931) (cherry picked from commit 4fa9d1f40fc85d8c70c93168dc812217db349359)
2024-07-17Fix coverity-1604665Neil Horman
Coverity issued an error in the opt_uintmax code, detecting a potential overflow on a cast to ossl_intmax_t Looks like it was just a typo, casting m from uintmax_t to ossl_intmax_t Fix it by correcting the cast to be ossl_uintmax_t, as would be expected Theres also some conditionals that seem like they should be removed, but I'll save that for later, as there may be some corner cases in which ossl_uintmax_t isn't equal in size to uintmax_t..maybe. Fixes openssl/private#567 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24897) (cherry picked from commit a753547eefc9739f341824a0cb0642afe7a06fcc)
2024-07-03fix: remove some odd empty linesRichard Levitte
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24776) (cherry picked from commit cfe0bbdecadaebc6ad7ba5a3335b7a03522c434f)
2024-07-03fix: openssl speed: RSA encryption is on the pubkey, not the privkeyRichard Levitte
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24776) (cherry picked from commit bb90a7861cbf27e29790b66077c23a2e9805014b)
2024-06-18CMP app: fix combination of -certout and -chainout with equal filename argumentDr. David von Oheimb
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/24267) (cherry picked from commit 5aec3f4a72604d76970581f1ea445b331beda608)
2024-06-04Copyright year updatesTomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-05-14apps/pkcs12: Not writing the private key file until the import password is ↵naaysayer
verified Fixes #904 CLA: trivial Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23729) (cherry picked from commit f5462572a1873482ce38646cbf00dfc483f02068)
2024-04-24Remove all references to FLOSS for NonStop Builds.Randall S. Becker
FLOSS is no longer a dependency for NonStop as of the deprecation of the SPT thread model builds. Fixes: #24214 Signed-off-by: Randall S. Becker <randall.becker@nexbridge.ca> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24217) (cherry picked from commit 0339382abad578ccb3989799ea2fb99dfb2d099b)
2024-04-22fix sending error when no root CA cert update availableRajeev Ranjan
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24169) (cherry picked from commit fc9649f61a8ac5f980da6807214fcbbbae1c45aa)
2024-04-15list_provider_info(): Fix leak on errorTomas Mraz
Fixes #24110 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24117) (cherry picked from commit 993c2407d04956ffdf9b32cf0a7e4938ace816dc)
2024-04-09APPS: Add missing OPENSSL_free() and combine the error handlerJiasheng Jiang
Add the OPENSSL_free() in the error handler to release the "*md_value" allocated by app_malloc(). To make the code clear and avoid possible future errors, combine the error handler in the "err" tag. Then, we only need to use "goto err" instead of releasing the memory separately. Since the EVP_MD_get_size() may return negative numbers when an error occurs, create_query() may fail to catch the error since it only considers 0 as an error code. Therefore, unifying the error codes of create_digest() from non-positive numbers to 0 is better, which also benefits future programming. Fixes: c7235be ("RFC 3161 compliant time stamp request creation, response generation and response verification.") Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/23873) (cherry picked from commit beb82177ddcd4b536544ceec92bb53f4d85d8e91)
2024-04-09Fix "Error finalizing cipher loop" when running openssl speed -evp -decryptTom Cosgrove
When using CCM, openssl speed uses the loop function EVP_Update_loop_ccm() which sets a (fake) tag when decrypting. When using -aead (which benchmarks a different sequence than normal, to be comparable to TLS operation), the loop function EVP_Update_loop_aead() is used, which also sets a tag when decrypting. However, when using defaults, the loop function EVP_Update_loop() is used, which does not set a tag on decryption, leading to "Error finalizing cipher loop". To fix this, set a fake tag value if we're doing decryption on an AEAD cipher in EVP_Update_loop(). We don't check the return value: this shouldn't really be able to fail, and if it does, the following EVP_DecryptUpdate() is almost certain to fail, so that can catch it. The decryption is certain to fail (well, almost certain, but with a very low probability of success), but this is no worse than at present. This minimal change means that future benchmarking data should be comparable to previous benchmarking data. (This is benchmarking code: don't write real apps like this!) Fixes #23657 Change-Id: Id581cf30503c1eb766464e315b1f33914040dcf7 Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23757) (cherry picked from commit b3be6cc89e4dcfafe8f8be97e9519c26af2d19f5)
2024-04-09Copyright year updatesTomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2024-04-04Diverse small VMS build fixupsRichard Levitte
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24008)
2024-04-02Fix openssl req with -addext subjectAltName=dirNameBernd Edlinger
The syntax check of the -addext fails because the X509V3_CTX is used to lookup the referenced section, but the wrong configuration file is used, where only a default section with all passed in -addext lines is available. Thus it was not possible to use the subjectAltName=dirName:section as an -addext parameter. Probably other extensions as well. This change affects only the syntax check, the real extension was already created with correct parameters. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23669) (cherry picked from commit 387418893e45e588d1cbd4222549b5113437c9ab)
2024-03-29Copyright year updatesMatt Caswell
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-03-26apps/req,crl: exit with 1 on verification failureVladimir Kotal
Fixes #23771 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23773) (cherry picked from commit 6af739b79ba50bd42ac8934747ab5c8b996f16b6)
2024-03-25Add NULL check before accessing PKCS7 encrypted algorithmViliam Lejčík
Printing content of an invalid test certificate causes application crash, because of NULL dereference: user@user:~/openssl$ openssl pkcs12 -in test/recipes/80-test_pkcs12_data/bad2.p12 -passin pass: -info MAC: sha256, Iteration 2048 MAC length: 32, salt length: 8 PKCS7 Encrypted data: Segmentation fault (core dumped) Added test cases for pkcs12 bad certificates Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23632) (cherry picked from commit a4cbffcd8998180b98bb9f7ce6065ed37d079d8b)
2024-03-20Copyright year updatesRichard Levitte
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-03-15apps/x509.c: No warning reading from stdin if redirectedTomas Mraz
Fixes #22893 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23526)
2024-03-12Use the untrusted certificate chain to create a valid certificate ID for ↵olszomal
OCSP_request Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22192)
2024-03-06apps/cmp: improve -reqin option to read fallback public key from first ↵Dr. David von Oheimb
request message file given Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21660)
2024-03-06apps/cmp: extend documentation and diagnostics for using -reqin in special ↵Dr. David von Oheimb
situations Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21660)
2024-03-06apps/cmp: add -reqout_only option for dumping/saving just the initial CMP ↵Dr. David von Oheimb
request message Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21660)
2024-03-06apps/cmp.c: refactor to fix some coding style nits and more convenient ↵Dr. David von Oheimb
source-level debugging Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21660)
2024-02-25apps/engine: add EC to list of capabilitiesMartin Oliveira
openssl engine -c wasn't showing if an engine implemented EC cla: trivial Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23538)
2024-02-22s_cb.c: Add missing return value checksMrRurikov
Return value of function 'SSL_CTX_ctrl', that is called from SSL_CTX_set1_verify_cert_store() and SSL_CTX_set1_chain_cert_store(), is not checked, but it is usually checked for this function. CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23647) (cherry picked from commit 6f794b461c6e16c8afb996ee190e084cbbddb6b8)
2024-02-06Add a missing space in an error messageVincent Lefèvre
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23481)
2024-01-25replace strstr() with strchr() for single charactersrilysh
strstr() is used to match multiple characters in the haystack, whereas strchr() is used to matched only single character. CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23347)
2024-01-25Add appropriate NULL checks in EVP_CIPHER apiNeil Horman
The EVP_CIPHER api currently assumes that calls made into several APIs have already initalized the cipher in a given context via a call to EVP_CipherInit[_ex[2]]. If that hasnt been done, instead of an error, the result is typically a SIGSEGV. Correct that by adding missing NULL checks in the apropriate apis prior to using ctx->cipher Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22995)
2024-01-24Fix a possible memory leak in req_mainBernd Edlinger
if the private key is output to stdout using the HARNESS_OSSL_PREFIX, out is a stack of BIOs and must therefore free'd using BIO_free_all. Steps to reproduce: $ HARNESS_OSSL_PREFIX=x OPENSSL_CONF=apps/openssl.cnf util/shlib_wrap.sh apps/openssl req -new -keyout - -passout pass: </dev/null [...] Direct leak of 128 byte(s) in 1 object(s) allocated from: #0 0x7f6f692b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7f6f686eda00 in CRYPTO_malloc crypto/mem.c:202 #2 0x7f6f686edba0 in CRYPTO_zalloc crypto/mem.c:222 #3 0x7f6f68471bdf in BIO_new_ex crypto/bio/bio_lib.c:83 #4 0x7f6f68491a8f in BIO_new_fp crypto/bio/bss_file.c:95 #5 0x555c5f58b378 in dup_bio_out apps/lib/apps.c:3014 #6 0x555c5f58f9ac in bio_open_default_ apps/lib/apps.c:3175 #7 0x555c5f58f9ac in bio_open_default apps/lib/apps.c:3203 #8 0x555c5f528537 in req_main apps/req.c:683 #9 0x555c5f50e315 in do_cmd apps/openssl.c:426 #10 0x555c5f4c5575 in main apps/openssl.c:307 #11 0x7f6f680461c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 SUMMARY: AddressSanitizer: 128 byte(s) leaked in 1 allocation(s). Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23365)
2024-01-17CMP app and doc: add -no_cache_extracerts option / ↵Dr. David von Oheimb
OSSL_CMP_OPT_NO_CACHE_EXTRACERTS Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19948)
2024-01-17CMP app: make -ignore_keyusage apply also for mock serverDr. David von Oheimb
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19948)
2024-01-16Add missing genpkey -rand supportViktor Dukhovni
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23294)
2024-01-15Remove receiving of unused return valueDrokov Pavel
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23277)
2024-01-15Error in s_server when -rev option is used with dtls.Frederik Wedel-Heinen
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23278)
2024-01-15Add apps/x509 -set_issuer & -set_subject option to override issuer & subjectJob Snijders
This changeset adds the counterpart to the '-subj' option to allow overriding the Issuer. For consistency, the `-subj` option is aliased to `-set_subject`. The issuer can be specified as following apps/openssl x509 -new -set_issuer '/CN=example-nro-ta' -subj '/CN=2a7dd1d787d793e4c8af56e197d4eed92af6ba13' ... This is useful in constructing specific test-cases or rechaining PKI trees Joint work with George Michaelson (@geeohgeegeeoh) Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23257)
2023-12-29apps: Don't print hostname on bio_out during connect.Sebastian Andrzej Siewior
Printing the hostname on bio_out clutters the output and breaks pipe like forwarding via openssl. Print the hostname via bio_err. Fixes #23013 Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23056)
2023-12-21cmp_server.c,apps/lib/cmp_mock_srv.c: move polling state checks to cmp_server.cRajeev Ranjan
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20727)
2023-12-21crypto/cmp/,apps/lib/cmp_mock_srv.c: various improvements on delayed deliveryDr. David von Oheimb
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20727)
2023-12-21crypto/cmp/,apps/lib/cmp_mock_srv.c: add delayed delivery for all types of ↵Rajeev Ranjan
responses Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20727)
2023-12-19CMP app: make -geninfo option accept multiple ITAVs and support string ↵Dr. David von Oheimb
values besides integers Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21281)
2023-12-19CMP lib and app: add optional certProfile request message header and ↵Dr. David von Oheimb
respective -profile option Also add missing getter functionss OSSL_CMP_{CTX,HDR}_get0_geninfo_ITAVs() to CMP API. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21281)
2023-12-13Harden asn1 oid loader to invalid inputsNeil Horman
In the event that a config file contains this sequence: ======= openssl_conf = openssl_init config_diagnostics = 1 [openssl_init] oid_section = oids [oids] testoid1 = 1.2.3.4.1 testoid2 = A Very Long OID Name, 1.2.3.4.2 testoid3 = ,1.2.3.4.3 ====== The leading comma in testoid3 can cause a heap buffer overflow, as the parsing code will move the string pointer back 1 character, thereby pointing to an invalid memory space correct the parser to detect this condition and handle it by treating it as if the comma doesn't exist (i.e. an empty long oid name) Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22957)
2023-12-13Fix genstr/genconf option in asn1parseNeil Horman
At some point the asn1parse applet was changed to default the inform to PEM, and defalt input file to stdin. Doing so broke the -genstr|conf options, in that, before we attempt to generate an ASN1 block from the provided genstr string, we attempt to read a PEM input from stdin. As a result, this command: openssl asn1parse -genstr OID:1.2.3.4 hangs because we are attempting a blocking read on stdin, waiting for data that never arrives Fix it by giving priority to genstr|genconf, such that, if set, will just run do_generate on that string and exit Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22957)
2023-12-13pkcs12: Do not forcibly load the config fileTomas Mraz
This was added as part of commit e869c86 but later it was made unnecessary by commit 21f7a09. Fixes #22994 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23005)
2023-12-12Fix a possible memleak in opt_verifyBernd Edlinger
The ASN1_OBJECT otmp was leaked if X509_VERIFY_PARAM_add0_policy fails. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22922)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-04 08:20:42 +0000