summaryrefslogtreecommitdiffstats
path: root/ssl
AgeCommit message (Collapse)Author
2024-01-30Copyright year updatesMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2024-01-19Document SSL_R_UNEXPECTED_EOF_WHILE_READINGMatt Caswell
Also document that it is ok to use this for control flow decisions. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23327) (cherry picked from commit b7275c5e5c1c7b025bf2eb74fd1344b6abe48c06)
2023-12-19Consolidate raising errors in SSL_CONF_cmd()Tomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23048) (cherry picked from commit 430dcbd0463573fece704263648cc15e891c3d49)
2023-12-19Always apply all configuration settings from the ssl sectionTomas Mraz
Even if some configuration entry is incorrect, do not skip the remaining ones. Fixes #20789 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23048) (cherry picked from commit 69c067ffbc2c02295e20c90e557b6fcb2f7da69c)
2023-12-12Don't attempt to set provider params on an ENGINE based cipherMatt Caswell
If an ENGINE has been loaded after the SSL_CTX has been created then the cipher we have cached might be provider based, but the cipher we actually end up using might not be. Don't try to set provider params on a cipher that is actually ENGINE based. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22865) (cherry picked from commit ed5f9ce63e98da2e7fddd55040c8e9e03f3af975)
2023-11-29Fix freshly introduced double-free.Viktor Dukhovni
We don't need the decoded X.509 Full(0) certificate for the EE usages 1 and 3, because the leaf certificate is always part of the presented chain, so the certificate is only validated as well-formed, and then discarded, but the TLSA record is of course still used after the validation step. Added DANE test cases for: 3 0 0, 3 1 0, 1 0 0, and 1 1 0 Reported by Claus Assmann. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22821) (cherry picked from commit f636e7e6bd8e06c6d84e42729b4131b4f5df488f)
2023-11-28Fix a possible memory leak in ct_move_sctsBernd Edlinger
Instead of trying to move the doomed sct back to the src stack, which may fail as well, simply free the sct object, as the src list will be deleted anyway. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22762) (cherry picked from commit a435d786046fabc85acdb89cbf47f154a09796e1)
2023-11-24Move freeing of an old enc_write_ctx/write_hash to dtls1_clear_sent_bufferMatt Caswell
When we are clearing the sent messages queue we should ensure we free any old enc_write_ctx/write_hash that are no longer in use. Previously this logic was in dtls1_hm_fragment_free() - but this can end up freeing the current enc_write_ctx/write_hash under certain error conditions. Fixes #22664 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2261) (cherry picked from commit 5e361b00c41a443c0c5954f7dd6f475d645b7f84)
2023-11-24zero data in hm_fragment on allocNeil Horman
if we allocate a new hm_frament in dtls1_buffer_message with dtls1_hm_fragment_new, the returned fragment contains uninitalized data in the msg_header field. If an error then occurs, and we free the fragment, dtls_hm_fragment_free interrogates the msg_header field (which is garbage), and potentially references undefined values, or worse, accidentally references available memory that is not owned, leading to various corruptions. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2261) (cherry picked from commit 02a2c3bc1336d2af1601fbc5d959c6babc1bce12)
2023-11-22Fix a possible use-after-free in custom_exts_freeBernd Edlinger
This may happen when ssl_cert_dup calls custom_exts_copy, where a possible memory allocation error causes custom_exts_free to be called twice: once in the error handling of custom_exts_copy and a second time in the error handling of ssl_cert_dup. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22772) (cherry picked from commit bc0773bbbd4d3ace6957385f1f22a5cda25dc94f)
2023-11-22Fix a possible memory leak in dane_tlsa_addBernd Edlinger
Several error cases leak either the X509 object or the pkey or the danetls_record object. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22743) (cherry picked from commit e4a94bcc77f3fda0f185e62a73a66d9b9b9388f5)
2023-11-09Fix a bad backportMatt Caswell
This is causing compilation failure Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22682) (cherry picked from commit 2fd4fd35bf906290a9c14b81f16e7ae01d297122)
2023-11-09Fix a possible memory leak of ssl->s3.tmp.pskBernd Edlinger
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22637) (cherry picked from commit a2b1ab6100d5f0fb50b61d241471eea087415632)
2023-11-08Fix a possible memory leak in custom_ext_addBernd Edlinger
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22639) (cherry picked from commit bd864f058c495d97e42007128d62f7fb19ae1818)
2023-11-02Fix a possible memory leak in load_builtin_compressionsBernd Edlinger
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22585) (cherry picked from commit daf26c2d7a4d29ec1040fc0d5d4215cfc2dcf4a7)
2023-09-19Copyright year updatesRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2023-09-18Enhance code safety and readability in SSL_get_shared_ciphers()Sumitra Sharma
This commit introduces two key improvements: 1. Improve code safety by replacing the conditional statement with `if (n >= size)` and using OPENSSL_strnlen() instead of strlen(). This change ensures proper buffer size handling and adheres to secure coding practices. 2. Enhance code readability by substituting `strcpy(p, c->name)` with `memcpy(p, c->name, n)`. This adjustment prioritizes code clarity and maintenance, even while mitigating a minimal buffer overflow risk. These enhancements bolster the code's robustness and comprehensibility, aligning with secure coding principles and best practices. Fixes #19837 Signed-off-by: Sumitra Sharma <sumitraartsy@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21934) (cherry picked from commit 2743594d73e65c38375c619e89ec62579e2c24a9)
2023-08-04Resolves some magic values that has a hello_retry_request enum type.Frederik Wedel-Heinen
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21636) (cherry picked from commit 5ac7ee4d5a38e4f163ed6a7c9c283d45038625a8)
2023-08-02A null pointer dereference occurs when memory allocation failsyangyangtiantianlonglong
Fixes #21605 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21606) (cherry picked from commit a8da305fa3dd6e34ba5aab3978281f652fd12883)
2023-08-01Copyright year updatesMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-07-17Fix ssl3_do_write() to correctly handle retriesMatt Caswell
A BIO is documented to return -1 on write retry - but sometimes they return 0. ssl3_do_write() was incorrectly handling a 0 response. Fixes #21422 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21435) (cherry picked from commit 034ea1d00e5816f35c3e4799d5c122e198e14b59)
2023-06-29Fix supported_groups handing in TLSv1.2Matt Caswell
In TLSv1.2 we should not attempt to use a supported_group value that is intended for use with TLSv1.3 - even if both the server and the client support it, e.g. the ffdhe groups are supported by OpenSSL for TLSv1.3 but not for TLSv1.2. Fixes #21081 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21295) (cherry picked from commit 01e765f0547eb67631820647a0cfeb9b3741491a)
2023-06-23Don't ask for an invalid group in an HRRMatt Caswell
If the client sends us a group in a key_share that is in our supported_groups list but is otherwise not suitable (e.g. not compatible with TLSv1.3) we reject it. We should not ask for that same group again in a subsequent HRR. Fixes #21157 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/21163) (cherry picked from commit 7a949ae5f1799a6629cf6deb44ae0f38455a73dd)
2023-05-30Update copyright yearTomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2023-05-12Clear ownership when duplicating sessionsWatson Ladd
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20848) (cherry picked from commit 9fdf9a44bbe3827fe653165a07281ccae8ab0947)
2023-04-25Fix regression of no-posix-io buildsTomas Mraz
Instead of using stat() to check if a file is a directory we just skip . and .. as a workaround. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/20786) (cherry picked from commit 3155b5a90e6ad9c7369d09e70e81686f4b321a73)
2023-03-31Handle app data records from the next epochMatt Caswell
It is possible that DTLS records are received out of order such that records from the next epoch arrive before we have finished processing the current epoch. We are supposed to buffer such records but for some reason we only did that for handshake and alert records. This is incorrect since it is perfectly possible for app data records to arrive early too. Fixes #20597 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20638)
2023-03-24tls1_set_groups_list: freeing *pext before overwritingPeter Kaestle
calling SSL_CTX_set1_groups_list() twice on one SSL_CTX* caused a memory leak visible in valgrind: 4 bytes in 1 blocks are definitely lost in loss record 1 of 1 at 0x4841888: malloc (vg_replace_malloc.c:381) by 0x4B1EE96: CRYPTO_memdup (in libcrypto.so.3) by 0x48993A0: tls1_set_groups_list (in libssl.so.3) by 0x487AA7E: ssl3_ctx_ctrl (in libssl.so.3) by 0x1091EA: main (mem_leak.c:10) LEAK SUMMARY: definitely lost: 4 bytes in 1 blocks Freeing *pext to fix it. CLA: trivial Signed-off-by: Peter Kaestle <peter.kaestle@nokia.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20317)
2023-03-15Remove spurious error queue entries on early dataMatt Caswell
Early data decryption is expected to fail sometimes. If it does we should not leave spurious error entries on the queue. Fixes #20377 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/20442) (cherry picked from commit d015b50dc9af0640c7c019a693368c3488d692d8)
2023-02-24Do not have more data in a pipeline than the split_send_fragmentMatt Caswell
We shouldn't be putting more data into a pipeline than the value of split_send_fragment. This is a backport of a fix which was included in a much larger commit in master (c6186792b98) related to moving the pipelining code into the new record layer that exists there. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20208) (cherry picked from commit 2c4b1c7b7b09c0e3f9f4246e8d6747678ea90363)
2023-02-24Fix read pipeliningMatt Caswell
During read pipelining we must ensure that the buffer is sufficiently large to read enough data to fill our pipelines. We also remove some code that moved data to the start of the packet if we can. This was unnecessary because of later code which would end up moving it anyway. The earlier move was also incorrect in the case that |clearold| was 0. This would cause the read pipelining code to fail with sufficiently large records. Fixes #20197 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20208) (cherry picked from commit 1d06598f0e9d9e39f9c206a2520777e696150257)
2023-02-24Pipeline output/input buf arrays must live until the EVP_Cipher is calledMatt Caswell
The pipeline input/output buf arrays must remain accessible to the EVP_CIPHER_CTX until EVP_Cipher is subsequently called. This fixes an asan error discovered by the newly added pipeline test. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20208) (cherry picked from commit df9c7ceefef59cc870c80346906471fabec62494)
2023-02-23Skip subdirectories in SSL_add_dir_cert_subjects_to_stack()olszomal
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20312) (cherry picked from commit 1dc35d44f355a7371a1ff8a457586938cc7b168a)
2023-02-07Update copyright yearRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-01-24Ensure our buffer allocation allows for the Explicit IVMatt Caswell
Some ciphers/protocol versions have an explicit IV. We need to make sure we have sufficient room for it in the underlying buffer. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20086) (cherry picked from commit 3be93f1b264d35ad93ceb71affacdef1b930c3c6)
2023-01-04Avoid possible divide by zeroTomas Mraz
Backport of commit 624efd2 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19967) (cherry picked from commit 8c29e5ebfd5f19442422ba43fea4c95816417e34)
2022-12-13Make error reason for disallowed legacy sigalg more specificTomas Mraz
The internal error reason is confusing and indicating an error in OpenSSL and not a configuration problem. Fixes #19867 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19875) (cherry picked from commit 97b8db1af2f71059ecea986e4d12fc6a23699a74)
2022-12-05Fix the check of BIO_set_write_buffer_size and BIO_set_read_buffer_sizePeiwei Hu
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19819) (cherry picked from commit 25d02f333b9a5531fa88db294f69a8347f275858)
2022-11-14Use the same encryption growth macro consistentlyMatt Caswell
We had two different macros for calculating the potential growth due to encryption. The macro we use for allocating the underlying buffer should be the same one that we use for reserving bytes for encryption growth. Also if we are adding the MAC independently of the cipher algorithm then the encryption growth will not include that MAC so we should remove it from the amount of bytes that we reserve for that growth. Otherwise we might exceed our buffer size and the WPACKET_reserve operation will fail. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19264) (cherry picked from commit 3d004cefec5135a3b080dc898d7f7d5452ef309f)
2022-11-02Fix the ceiling on how much encryption growth we can haveMatt Caswell
Stitched ciphersuites can grow by more during encryption than the code allowed for. We fix the calculation and add an assert to check we go it right. Note that this is not a security issue. Even though we can overflow the amount of bytes reserved in the WPACKET for the encryption, the underlying buffer is still big enough. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19517) (cherry picked from commit eaa206007322ab0b1eaf9f83485e56deafc9df80)
2022-10-26ssl_cipher_process_rulestr: don't read outside rule_str bufferTodd C. Miller
If rule_str ended in a "-", "l" was incremented one byte past the end of the buffer. This resulted in an out-of-bounds read when "l" is dereferenced at the end of the loop. It is safest to just return early in this case since the condition occurs inside a nested loop. CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19166) (cherry picked from commit 428511ca66670e169a0e1b12e7540714b0be4cf8)
2022-10-21stack: Do not add error if pop/shift/value accesses outside of the stackTomas Mraz
This partially reverts commit 30eba7f35983a917f1007bce45040c0af3442e42. This is legitimate use of the stack functions and no error should be reported apart from the NULL return value. Fixes #19389 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19400) (cherry picked from commit a8086e6bfc37355626393751a94bc5c92df7e9d3)
2022-10-19Ensure that the key share group is allowed for our protocol versionMatt Caswell
We should never send or accept a key share group that is not in the supported groups list or a group that isn't suitable for use in TLSv1.3 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19404)
2022-10-11Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes (Merged from https://github.com/openssl/openssl/pull/19382)
2022-09-28Test TLS extension orderingTodd Short
Adding extensions is fragile, with the TLSEXT_TYPE entry needing to be located at TLSEXT_IDX in the array. This adds a test to ensure extensions are in the correct order. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19269) (cherry picked from commit ac44deaf00ad24fd18b9d74de4a23d98a2b75c8d)
2022-09-27ssl_log_secret call in tls13_key_updatevisbjn
Newly computed traffic secrets are now logged upon key update Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19241) (cherry picked from commit 2f7e61b8b21ed472a3667b8922843851f94a3d93)
2022-09-27If a ticket key callback returns 0 in TLSv1.3 don't send a ticketMatt Caswell
If we can't construct the ticket don't send one. This requires a change to the TLS state machine to be able to a handle a construction function deciding not to send a message after all. Fixes #18977 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19249)
2022-09-22Correctly handle a retransmitted ClientHelloMatt Caswell
If we receive a ClientHello and send back a HelloVerifyRequest, we need to be able to handle the scenario where the HelloVerifyRequest gets lost and we receive another ClientHello with the message sequence number set to 0. Fixes #18635 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18654) (cherry picked from commit 81926c91567cd5d11eec38b9980438f45b276d72)
2022-09-16stack.c: add missing direct error reporting and improve coding styleDr. David von Oheimb
Doing so, had to fix sloppiness in using the stack API in crypto/conf/conf_def.c, ssl/ssl_ciph.c, ssl/statem/statem_srvr.c, and mostly in test/helpers/ssltestlib.c. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/18918) (cherry picked from commit 30eba7f35983a917f1007bce45040c0af3442e42)
2022-09-06Coverity 1513478: negative returnPauli
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19126) (cherry picked from commit 1d1537067304b8c8d87b2df393363b40370ad640)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-09 08:27:39 +0000