summaryrefslogtreecommitdiffstats
path: root/src/providers
Commit message (Collapse)AuthorAgeFilesLines
...
* IPA: Check master domain record before subdomain recordsJakub Hrozek2015-06-141-14/+28
| | | | | | | | | | | | | | | | | | | | For one-way trusts we need to know the flat name of the IPA domain when we process subdomains, hence we need to swap the processing order and read the master domain record sooner. Previsouly the order was: - ranges - subdomains - if on client, views - master Now the order is: - ranges - master - subdomains - if on client, views Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: Add ipa_subdomains_handler_get_{start,cont} wrappersJakub Hrozek2015-06-141-13/+34
| | | | | | | | | | Previously it was error-prone to move code around, because the functions that started next subdomain request were scattered together with moving to next base or assigning next base. This patch creates a wrappers for better readability. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Add realm to sysdb_master_domain_add_infoJakub Hrozek2015-06-143-2/+30
| | | | | | | | | | Adding realm to both master domain and subdomain will make it easier to set and select forest roots. Even master domains can be forest members, it's preferable to avoid special-casing as much as possible. Includes a unit test. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Store trust direction for subdomainsJakub Hrozek2015-06-142-2/+2
| | | | | | | | | | | | We need to store the subdomain trust direction in order to recover the structure after SSSD restart. The trust direction is a plain uint32_t to avoid leaking the knowledge about AD trust directions to sysdb while at the same time making it easy to compare values between sysdb and LDAP and avoid translating the values. Reviewed-by: Sumit Bose <sbose@redhat.com>
* SDAP: Log failure from sysdb_handle_original_uuidLukas Slebodnik2015-06-141-0/+6
| | | | Reviewed-by: Michal Židek <mzidek@redhat.com>
* IPA: Don't override homedir with subdomain_homedirPavel Reichl2015-06-141-7/+23
| | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2583 Reviewed-by: Michal Židek <mzidek@redhat.com>
* subdomains: Inherit cleanup period and tokengroup settings from parent domainJakub Hrozek2015-06-054-0/+70
| | | | | | | | | | | Allows the administrator to extend the functionality of ldap_purge_cache_timeout, ldap_user_principal and ldap_use_tokengroups to the subdomains. This is a less intrusive way of achieving: https://fedorahosted.org/sssd/ticket/2627 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* SDAP: Add sdap_copy_map_entryJakub Hrozek2015-06-052-0/+21
| | | | Reviewed-by: Pavel Reichl <preichl@redhat.com>
* DP: Add a function to inherit DP options, if setJakub Hrozek2015-06-052-0/+62
| | | | | | | | | | | Related to: https://fedorahosted.org/sssd/ticket/2644 Adds a utility function that checks if a DP option is present in the subdomain_inherit list. If it is, then the option is set from source to destination dp_option array. Reviewed-by: Pavel Reichl <preichl@redhat.com>
* krb: remove duplicit decl. of write_krb5info_filePavel Reichl2015-06-051-3/+0
| | | | | | function write_krb5info_file() was declared twice in krb5_common.h Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* dyndns: ipa_dyndns.h missed declaration of used dataPavel Reichl2015-06-051-0/+4
| | | | | | ipa_dyndns.h was depended on header files included before it. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* dyndns: don't pass zone directive to nsupdatePavel Reichl2015-06-041-1/+9
| | | | | | | | | | | | | | | | | | | | | | Don't pass zone directive to nsupdate for the first pass. The information about zone should be generated by nsupdate which has auto-detection logic for zone value. The previous version code sometime worked but it broke when client domain was not the same as FreeIPA domain. Log without patch applied: [ipa_dyndns_update_send] (0x0400): Performing update [ipa_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [5]: Input/output error [ipa_dyndns_nsupdate_done] (0x0040): Updating DNS entry failed [5]: Input/output error Log after patch applied: [ipa_dyndns_update_send] (0x0400): Performing update [ipa_dyndns_nsupdate_done] (0x0040): DNS update finished Resolves: https://fedorahosted.org/sssd/ticket/2540 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* dyndns: remove dupl declaration of ipa_dyndns_updatePavel Reichl2015-06-021-3/+0
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* ldap: use proper sysdb name in groups_by_user_done()Sumit Bose2015-06-011-3/+12
| | | | | | | | | | | | | | | | In a recent change set_initgroups_expire_attribute() was added to groups_by_user_done() to make sure that the initgroups timeout is only added to the user object until all groups added to the cache. This change (and the original code in groups_by_user_done() as well) didn't took sub-domain users into account where the name in sysdb might different form the original request and the domain is not the configured domain. This patch tries to ensure that the right name and domain are used. https://fedorahosted.org/sssd/ticket/2663 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* SDAP: Check return value before using output argumentsLukas Slebodnik2015-06-011-6/+8
| | | | | | | | | | | | | | | | | | | ==18139== Conditional jump or move depends on uninitialised value(s) ==18139== at 0x14400F1B: generic_ext_search_handler.isra.3 (sdap_async.c:1626) ==18139== by 0x879D7E3: tevent_common_loop_immediate (tevent_immediate.c:135) ==18139== by 0x87A20CD: epoll_event_loop_once (tevent_epoll.c:907) ==18139== by 0x87A07D6: std_event_loop_once (tevent_standard.c:114) ==18139== by 0x879CFBC: _tevent_loop_once (tevent.c:530) ==18139== by 0x879D15A: tevent_common_loop_wait (tevent.c:634) ==18139== by 0x87A0776: std_event_loop_wait (tevent_standard.c:140) ==18139== by 0x5293862: server_loop (server.c:668) ==18139== by 0x10EA41: main (data_provider_be.c:2909 Related tickets: https://fedorahosted.org/sssd/ticket/2645 https://fedorahosted.org/sssd/ticket/2662 Reviewed-by: Pavel Reichl <preichl@redhat.com>
* Skip enumeration requests in IPA and AD providers as wellJakub Hrozek2015-06-014-29/+32
| | | | | | | | | | | | | | Checking the enum request in the underlying LDAP provider to skip it might be too late as the richer IPA or AD providers depend on having a useful result when the sdap request finishes. Move the enumeration check earlier instead and allow directly in the IPA or AD handler. Related: https://fedorahosted.org/sssd/ticket/2659 Reviewed-by: Sumit Bose <sbose@redhat.com>
* DP: Set extra_value to NULL for enum requestsJakub Hrozek2015-06-011-1/+2
| | | | | | | | | | | | Some providers, notably IPA, rely on extra_value to be either a useful value or NULL. In enumeration, however, extra_value was random. Set the extra_value pointer explicitly to NULL to make it clear that it's not used for enumeration and also use talloc_zero as future-proof. Resolves: https://fedorahosted.org/sssd/ticket/2659 Reviewed-by: Sumit Bose <sbose@redhat.com>
* PROXY: Do not register signal with SA_SIGINFOLukas Slebodnik2015-05-311-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Argument "siginfo_t *siginfo" (void *__siginfo) was not used in signal handlers pc_init_sig_handler, proxy_child_sig_handler. siginfo is mostly used for additional information for about signal and precesses (@see man 2 sigaction) and we store needed information in custom context (private_data); It's tevent style. Why backend crashed: proxy_child_init_send creates request; forks a process and register handler for signal SIGCHLD. Talloc parent of tevent_signal is previously created request. If proxy_child fails (return code is not 0) then SIGCHLD is received handler pc_init_sig_handler is called. However pc_init_sig_handler can call tevent_req_error for request which calls request callback and released request. tevent_signal_destructor was called as a part of releasing tevent_signal. The destructor cleared siginfo in ring buffer for first time. Then tevent tried to clear the same siginfo in ring buffer for the secont time after returning from signal hander (pc_init_sig_handler). But it was already cleared and it caused dereference of NULL pointer. Resolves: https://fedorahosted.org/sssd/ticket/2654 Reviewed-by: Michal Židek <mzidek@redhat.com>
* PROXY: proxy_child should work in non-root modeLukas Slebodnik2015-05-311-1/+1
| | | | | | | | | | | | | | | | | | | According to design page[1], proxy_child should run with root privileges in non-root mode however proxy_child did not have setuid bit. After setting setuid bit proxy_child will be executed with extra privileges. The effective user ID will be 0 but effective group ID will be still the same as egid of sssd_be. Therefore gid of private pipe for proxy_child should be the same. Otherwise proxy_child will fail due to wrong permissions of unix pipe (sbus_client_init -> check_file) [1] https://fedorahosted.org/sssd/wiki/DesignDocs/NotRootSSSD Resolves: https://fedorahosted.org/sssd/ticket/2655 Reviewed-by: Michal Židek <mzidek@redhat.com>
* Download complete groups if ignore_group_members is set with tokengroupsJakub Hrozek2015-05-311-2/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2644 When tokenGroups are enabled, we save groups using their SID as the RDN attribute during initgroups() and later, if the groups is requested and saved again with the full name, remove the original and save the new group entry. Saving the new group entry would break if ignore_group_members is also set, because the new group entry would lack the "member" attribute, so the member/memberof links between the new group and the user entry wouldn't be established again. This patch changes the initgroups processing so that the full group object is fetched when initgroups is enabled but together with ignore_group_members. This solution imposes some performance impact, because instead of one search for tokenGroups we also need to resolve the groups. The more systematic solution would be to get rid of removing the group entry as described in https://fedorahosted.org/sssd/ticket/2656 To reproduce the bug, set: ignore_group_members = True with a backend that uses: id_provider = ad Then run: $ id aduser@ad_domain.com $ id aduser@ad_domain.com Reviewed-by: Sumit Bose <sbose@redhat.com>
* AD GPO: Change default to "enforcing"Stephen Gallagher2015-05-281-1/+2
| | | | | | | | | | | | | | | | | When a user enrolls a system against Active Directory, the expectation is that the client will honor the centrally-managed settings. In the past, we avoided changing the default (and left it in permissive mode, to warn admins that the security policy wasn't being honored) in order to avoid breaking existing Active Directory enrollments. However, sufficient time has likely passed for users to become accustomed to using GPOs to manage access-control for their systems. This patch changes the default to enforcing and adds a configure flag for distributions to use if they wish to provide a different default value. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* AD GPO: Support processing referralsStephen Gallagher2015-05-284-46/+446
| | | | | | | | | | | | For GPOs assigned to a site, it's possible that their definition actually exists in another domain. To retrieve this information, we need to follow the referral and perform a base search on another domain controller. Resolves: https://fedorahosted.org/sssd/ticket/2645 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: Support returning referral informationStephen Gallagher2015-05-281-22/+112
| | | | | | | | | Some callers may be interested in the raw referral values returned from a lookup. This patch allows interested consumers to get these referrals back and process them if they wish. It does not implement a generic automatic following of referrals. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: new option krb5_map_userPavel Reichl2015-05-2810-15/+215
| | | | | | | | | | New option `krb5_map_user` providing mapping of ID provider names to Kerberos principals. Resolves: https://fedorahosted.org/sssd/ticket/2509 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Remove unnecessary argument from sdap_save_userLukas Slebodnik2015-05-224-6/+3
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SDAP: Set initgroups expire attribute at the endLukas Slebodnik2015-05-222-9/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | Initgrups consisted of two main steps: 1. store user to cache 2. store all user groups to cache. Previously the attribute SYSDB_INITGR_EXPIRE was set in the first step. So in case of epmty cache and parallel initgroups request in responders there was a small period when SYSDB_INITGR_EXPIRE was valid but groups were not cached. Therefore sometime responder could return zero supplementary groups. This patch moves the setting of initgroups expire attribute from 1st step to the end of 2nd step. In case of parallel initgroups requests in responder there are two other ways how we could get correct results even thought there was a bug. a) Time between two request was too small. User was not stored in cache yet and 2nd request waited for response from DP. b) Time between two request was big enough. All users groups were successfully stored in cache and 2nd request returned correct results. Resolves: https://fedorahosted.org/sssd/ticket/2634 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* LDAP: Remove dead assignmentLukas Slebodnik2015-05-181-1/+0
| | | | | | | | | The variable ret was not read when function sysdb_has_enumerated returned ENOENT. Just boolean variable has_enumerated need to be changed. This dead assignment caused warning from clang static analyser Value stored to 'ret' is never read Reviewed-by: Pavel Reichl <preichl@redhat.com>
* LDAP: warn about lockout option being deprecatedPavel Reichl2015-05-141-1/+8
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* krb5: remove field run_as_userPavel Reichl2015-05-142-15/+0
| | | | | | run_as_user is set set but never read. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: disable the cleanup task by defaultJakub Hrozek2015-05-124-3/+22
| | | | | | | | | | | | | | | | | | | | | | | Resolves: https://fedorahosted.org/sssd/ticket/2627 The cleanup task was designed to keep the cache size within certain limits. This is how it roughly works now: - find users who have never logged in by default. If account_cache_expiration is set, find users who loggged in later than account_cache_expiration - delete the matching set of users - find groups that have no members - delete the matching set of groups So unless account_cache_expiration is set to something sensible, only empty groups and expired users who never logged in are removed and that's quite a corner case. The above effectivelly walks the whole database, especially the groups step is quite slow with a huge database. The whole cleanup task also runs in a single sysdb transaction, which means all other transactions are blocked while the cleanup task crunches the database. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: do not fail if view name lookup failed on older versionsSumit Bose2015-05-121-1/+8
| | | | | | | | | | | | | | Depending on the version 389ds return a different error code if the search for the view name failed because our dereference attribute ipaAssignedIDView is not known. Newer version return LDAP_UNAVAILABLE_CRITICAL_EXTENSION(12) which is translated to EOPNOTSUPP and older versions return LDAP_PROTOCOL_ERROR(2) which is returned as EIO. In both cases we have to assume that the server is not view aware and keep the view name unset. Resolves https://fedorahosted.org/sssd/ticket/2650 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: use DN to update entrySumit Bose2015-05-111-1/+2
| | | | | | | | | | | | | | | sdap_nested_group_populate_users() has code to handle user name changes. It updates the SYSDB_NAME attribute. This attribute is also used in the RDN but changing the attribute in the object does not change the DN hence the DN still contains the old name. Currently sysdb_set_user_attr() was used to update the entry which creates the DN based on the give name. This will fail if the name is changed for a second time. Since the DN is already available in the search result it is more reliable to use it directly with sysdb_set_entry_attr(). Related to https://fedorahosted.org/sssd/ticket/2591 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* LDAP: return after tevent_req_errorJakub Hrozek2015-05-111-0/+1
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5: try delayed online authentication only for single factor authSumit Bose2015-05-081-0/+7
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5: save hash of the first authentication factor to the cacheSumit Bose2015-05-081-3/+23
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: create preauth indicator file at startupSumit Bose2015-05-081-0/+66
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* krb5-child: add preauth and split 2fa token supportSumit Bose2015-05-083-21/+251
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* Add pre-auth requestSumit Bose2015-05-084-0/+6
| | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* IPA: allow initgroups by UUID for FreeIPA usersSumit Bose2015-05-065-17/+34
| | | | | | | | | | | If a FreeIPA user is searched with the help of an override name the UUID from the override anchor is used to search the user. Currently the initgroups request only allows searches by SID or name. With this patch a UUID can be used as well. Related to https://fedorahosted.org/sssd/ticket/2642 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: do not add domain name unconditionallySumit Bose2015-05-061-0/+2
| | | | | | | | | | | Depending on the server-side configuration the extdom plugin can return short or fully qualified names for IPA objects. The client must handle the names according to its own configuration and not add the domain part of the fully-qualified name unconditionally. Resolves https://fedorahosted.org/sssd/ticket/2647 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: search for overrides during initgroups in sever modeSumit Bose2015-05-051-0/+69
| | | | | | | | | | After the group memberships of a user from a trusted domain are read it must be checked if there are overrides for the discovered groups to be able to return the right gid or name to the caller. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: enhance ipa_initgr_get_overrides_send()Sumit Bose2015-05-052-17/+56
| | | | | | | | | This patch makes ipa_initgr_get_overrides_send() public and add support to search overrides by UUID or by SID. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: update initgr expire timestamp conditionallySumit Bose2015-05-051-8/+11
| | | | | | | | | | | | | | | Newer versions of the extdom plugin return the full list of group-memberships during user lookups. As a result the lifetime of the group-membership data is updates in those cases. But if the user is not looked up directly but is resolved as a group member during a group lookup SSSD does not resolve all group-membership of the user to avoid deep recursion and eventually a complete enumeration of the user and group base. In this case the lifetime of the group-memberships should not be updated because it might be incomplete. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: do initgroups if extdom exop supports itSumit Bose2015-05-053-10/+21
| | | | | | | | | | | | | | Newer versions of the extdom plugin return the full list of group-memberships during a user lookup request. With these version there is no need to reject a initgroups request for sub/trusted-domain users anymore. This is e.g. useful for callers which call getgrouplist() directly without calling getpwnam() before. Additionally it helps if for some reasons the lifetime of the user entry and the lifetime of the initgroups data is different. Related to https://fedorahosted.org/sssd/ticket/2633 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SDAP: Fix id mapping with disabled subdomainsLukas Slebodnik2015-05-051-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If subdomains are disabled "subdomain_provider = none" then auto-discovery discovery of domain SID is disabled. It is possible to configure options ldap_idmap_default_domain{,_sid} and id mapping should work. However value of option ldap_idmap_default_domain_sid was not assigned to sss_domain_info for main domain. It was only used for initialisation of sdap_idmap_ctx. As a result of this bug posix attributes were used in ldap filter and id mapping worked just for users with posix attributes. [be_get_account_info] (0x0100): Got request for [0x1001][1][name=user] [be_req_set_domain] (0x0400): Changing request domain from [EXAMPLE.TEST] to [EXAMPLE.TEST] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)] [sdap_idmap_domain_has_algorithmic_mapping] (0x0080): Could not parse domain SID from [(null)] [sdap_search_user_next_base] (0x0400): Searching for users with base [DC=EXAMPLE,DC=TEST] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(sAMAccountName=hdpadmin)(objectclass=user) (sAMAccountName=*)(&(uidNumber=*)(!(uidNumber=0))))] [DC=EXAMPLE,DC=TEST]. [sdap_search_user_process] (0x0400): Search for users, returned 0 results. [sdap_get_users_done] (0x0040): Failed to retrieve users Resolves: https://fedorahosted.org/sssd/ticket/2635 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* GPO: Do not ignore missing attrs for GPOsLukas Slebodnik2015-04-301-3/+9
| | | | | | | | | | | | | | | | | | | | | | | | We don't want to skip over a GPO that might properly be denying users. [sssd[be[a.foo.com]]] [sdap_sd_search_send] (0x0400): Searching entry [cn={2BA15B73-9524-419F-B4B7-185E1F0D3DCF},cn=policies,cn=system,DC=foo,DC=com] using SD [sssd[be[a.foo.com]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=*)][cn={2BA15B73-9524-419F-B4B7-185E1F0D3DCF},cn=policies,cn=system,DC=lzb,DC=hq]. [sssd[be[a.foo.com]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT] [sssd[be[a.foo.com]]] [sdap_get_generic_op_finished] (0x0400): Search result: Referral(10), 0000202B: RefErr: DSID-0310063C, data 0, 1 access points ref 1: 'lzb.hq' [sssd[be[a.foo.com]]] [sdap_get_generic_op_finished] (0x1000): Ref: ldap://foo.com/cn=%7B2BA15B73-9524-419F-B4B7-185E1F0D3DCF%7D,cn=policies,cn=system,DC=foo,DC=com [sssd[be[a.foo.com]]] [ad_gpo_get_gpo_attrs_done] (0x0040): no attrs found for GPO; try next GPO. Resolves: https://fedorahosted.org/sssd/ticket/2629 Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
* IPA: fix segfault in ipa_s2n_exopAron Parsons2015-04-291-1/+1
| | | | | | | | can be triggered on demand by assigning a POSIX group with external members sudo privileges, then dropping the cache and doing a sudo -U <user> -l. Reviewed-by: Sumit Bose <sbose@redhat.com>
* IPA: allow initgroups by SID for AD usersSumit Bose2015-04-294-2/+29
| | | | | | | | | | | If a user from a trusted AD domain is search with the help of an override name the SID from the override anchor is used to search the user in AD. Currently the initgroups request only allows searches by name. With this patch a SID can be used as well. Resolves https://fedorahosted.org/sssd/ticket/2632 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* simple-access-provider: make user grp res more robustPavel Reichl2015-04-281-4/+22
| | | | | | | | | Not all user groups need to be resolved if group deny list is empty. Resolves: https://fedorahosted.org/sssd/ticket/2519 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* IPA: check ghosts in groups found by uuid as wellSumit Bose2015-04-271-9/+12
| | | | | | | | | | | | With views and overrides groups are not allowed to have ghost members anymore because the name of a member might be overridden. To achieve this ghost members are looked up and resolved later during group lookups. Currently this is only done for group lookups by name but should happen as well if the group is looked up by uuid. Resolves https://fedorahosted.org/sssd/ticket/2631 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-28 00:19:42 +0000