rpms/cifs-utils
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import Oracle_OSS cifs-utils-7.6-2.el10_2

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-07-21 06:49:22 -04:00
parent c7f2096e4f
commit d9b5686329
7 changed files with 456 additions and 125 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1 @@
cifs-utils-7.4.tar.bz2
cifs-utils-7.6.tar.bz2

24
cifs-utils.spec
View File

@ -1,8 +1,8 @@
## START: Set by rpmautospec
## (rpmautospec version 0.8.1)
## (rpmautospec version 0.8.4)
## RPMAUTOSPEC: autorelease, autochangelog
%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
release_number = 1;
release_number = 2;
base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
print(release_number + base_release_number - 1);
}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@ -14,7 +14,7 @@
%global bash_completion_dir %(pkg-config --variable=completionsdir bash-completion || echo /etc/bash_completion.d)
Name: cifs-utils
Version: 7.4
Version: 7.6
Release: %autorelease
Summary: Utilities for mounting and managing CIFS mounts
@ -34,8 +34,8 @@ Recommends: %{name}-info%{?_isa} = %{version}-%{release}
Source0: https://download.samba.org/pub/linux-cifs/cifs-utils/%{name}-%{version}.tar.bz2
Patch0: cifscreds-fix-parsing-of-commands-and-parameters.patch
Patch1: docs-update-echo_interval-description.patch
Patch0: cifs.upcall-fix-compiler-warning-with-Wvla.patch
Patch1: cifs.upcall-fix-regression-with-krb5-creduid.patch
%description
The SMB/CIFS protocol is a standard file sharing protocol widely deployed
@ -143,8 +143,18 @@ about CIFS mount.
%changelog
## START: Generated by rpmautospec
* Fri Nov 28 2025 Paulo Alcantara <paalcant@redhat.com> - 7.4-1
- resolves: RHEL-131408 - fix regression with cifscreds(1)
* Tue Jul 07 2026 Paulo Alcantara <paalcant@redhat.com> - 7.6-2
- resolves: RHEL-192935 - fix krb5 mount regression
* Thu Jun 25 2026 Paulo Alcantara <paalcant@redhat.com> - 7.6-1
- Update to version 7.6
- resolves: RHEL-185756 - CVE-2026-12505 cifs-utils: LPE via cifs.spnego
* Wed Feb 04 2026 Paulo Alcantara <paalcant@redhat.com> - 7.5-1
- resolves: RHEL-146310 - Enable debug logs in cifs.upcall
* Thu Nov 27 2025 Paulo Alcantara <pc@manguebit.org> - 7.4-1
- resolves: RHEL-131409 - fix regression with cifscreds(1)
* Fri Mar 07 2025 Paulo Alcantara <paalcant@redhat.com> - 7.2-1
- resolves: RHEL-82681 - Update to version 7.2

46
cifs.upcall-fix-compiler-warning-with-Wvla.patch Normal file
View File

@ -0,0 +1,46 @@
From d2f39a20d68aa55023b63e575f06941721e644c6 Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@manguebit.org>
Date: Tue, 23 Jun 2026 15:06:20 -0300
Subject: [PATCH] cifs.upcall: fix compiler warning with -Wvla
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The length value for @path array in get_uidgid() needs to be evaluated
at compile time, so replace strlen() with sizeof() when defining
PROC_PID_PATH_MAXLEN and then fix the following warning:
cifs.upcall.c: In function ‘get_uidgid’:
cifs.upcall.c:1400:9: warning: ISO C90 forbids array ‘path’ whose size
cannot be evaluated [-Wvla]
1400 | char path[PROC_PID_PATH_MAXLEN] = {}, buf[256];
| ^~~~
Fixes: 972c5b5ff95e ("cifs.upcall: remove getpwuid() dependency")
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Cc: Enzo Matsumiya <ematsumiya@suse.de>
Cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
---
cifs.upcall.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/cifs.upcall.c b/cifs.upcall.c
index 01690dfcade1..11dbc6186a74 100644
--- a/cifs.upcall.c
+++ b/cifs.upcall.c
@@ -1375,8 +1375,8 @@ static int ip_to_fqdn(const char *addrstr, char *host, size_t hostlen)
return 0;
}
-/* cover worst case/impossible scenarios, + 1 for NUL */
-#define PROC_PID_PATH_MAXLEN ((int)strlen("/proc/2147483647/status") + 1)
+/* cover worst case/impossible scenarios */
+#define PROC_PID_PATH_MAXLEN ((int)sizeof("/proc/2147483647/status"))
/* max valid UID/GID is (UINT_MAX - 1) */
#define INVALID_UIDGID UINT_MAX
--
2.54.0

391
cifs.upcall-fix-regression-with-krb5-creduid.patch Normal file
View File

@ -0,0 +1,391 @@
From e9495963e0d5c26f7d0137829d8dc625130b53cc Mon Sep 17 00:00:00 2001
From: Enzo Matsumiya <ematsumiya@suse.de>
Date: Mon, 6 Jul 2026 10:55:55 -0300
Subject: [PATCH] cifs.upcall: fix regression with krb5 + creduid
Commit 972c5b5ff95e ("cifs.upcall: remove getpwuid() dependency")
introduced a regression when using creduid != uid (e.g.
"mount.cifs -o sec=krb5,cruid=X"), so 'uid' local var is replaced
with procfs "Uid" value (in the example, the one from mount.cifs).
That commit ignored the fact that:
mount UID can be different from creds UID, and that calling-app
process (post-mount) can be different from both
This patch "reverts" 972c5b5ff95e ("cifs.upcall: remove getpwuid()
dependency"); transform the "emergency"-added function get_uidgid()
into map_uidgid(), now only used to do NS UID/GID mapping.
Also add getpwuid() back, but this time called while still on host
namespace, so any possible custom NSS module is ran as allowed by
sysadmin.
Any scenario involving unmapped UIDs or GIDs is unsupported; this
means that any UID:GID in a child user namespace _must_ map back to
a valid and existing host UID:GID.
Fixes: 972c5b5ff95e ("cifs.upcall: remove getpwuid() dependency")
Reported-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
---
cifs.upcall.c | 279 ++++++++++++++++++++++++++++++++------------------
1 file changed, 177 insertions(+), 102 deletions(-)
diff --git a/cifs.upcall.c b/cifs.upcall.c
index 747617790576..42205e66a676 100644
--- a/cifs.upcall.c
+++ b/cifs.upcall.c
@@ -52,6 +52,7 @@
#include <arpa/inet.h>
#include <ctype.h>
#include <grp.h>
+#include <pwd.h>
#include <stdbool.h>
#include <errno.h>
#include <sched.h>
@@ -1375,118 +1376,170 @@ static int ip_to_fqdn(const char *addrstr, char *host, size_t hostlen)
return 0;
}
-/* cover worst case/impossible scenarios */
-#define PROC_PID_PATH_MAXLEN ((int)sizeof("/proc/2147483647/status"))
-/* max valid UID/GID is (UINT_MAX - 1) */
-#define INVALID_UIDGID UINT_MAX
+#define ID_MAP_PATH_MAX ((int)sizeof("/proc/2147483647/uid_map"))
-/*
- * get_uidgid - Get @pid's (real) UID and/or GID.
- * @pid: process to get UID/GID from
- * @uidp: pointer to store @pid's UID (can be NULL)
- * @gidp: pointer to store @pid's GID (can be NULL)
- *
- * Extract "Uid:" and "Gid:" fields from /proc/@pid/status.
- * Do so based on whether @uidp or @gidp are NULL.
- *
- * This function assumes we're on the same namespace as @pid.
- *
- * Return: 0 on success, -1 otherwise (errno set).
- *
- * On errors, *@uidp and *@gidp are set to INVALID_UIDGID.
- */
-static int get_uidgid(pid_t pid, uid_t *uidp, gid_t *gidp)
+static int map_id(pid_t pid, const char *map, unsigned int *idp)
{
- char path[PROC_PID_PATH_MAXLEN] = {}, buf[256];
+ unsigned long long ns_start, host_start, range;
+ char map_path[ID_MAP_PATH_MAX];
+ int map_path_size = sizeof(map_path);
+ unsigned int id;
FILE *fp = NULL;
- int ret;
+ int ret = 1;
- errno = 0;
- if (pid < 0 || (!uidp && !gidp)) {
- errno = EINVAL;
- return -1;
- }
+ errno = EINVAL;
+ if (pid < 0 || !map || !idp || *idp == UINT_MAX)
+ goto out;
- if (uidp)
- *uidp = INVALID_UIDGID;
-
- if (gidp)
- *gidp = INVALID_UIDGID;
-
- ret = snprintf(path, PROC_PID_PATH_MAXLEN, "/proc/%d/status", pid);
- if (ret < 0 || ret >= PROC_PID_PATH_MAXLEN) {
- if (!errno)
+ ret = snprintf(map_path, map_path_size, "/proc/%d/%s", pid, map);
+ if (ret < 0 || ret >= map_path_size) {
+ if (ret >= map_path_size)
errno = ENAMETOOLONG;
- return -1;
+ ret = 1;
+ goto out;
}
- fp = fopen(path, "r");
- if (!fp) {
- ret = -1;
+ ret = 1;
+ fp = fopen(map_path, "r");
+ if (!fp)
goto out;
- }
- /* Parse /proc/pid/status fields */
- errno = 0;
- ret = -1;
- while (fgets(buf, 256, fp)) {
- unsigned long long val;
+ /*
+ * The map files have the same format:
+ * <NS ID start> <host ID start> <range>
+ * ... (<multiple entries are supported) ...
+ *
+ * Formula and validation:
+ * <final NS ID> = (*@idp - <host ID start>) + <NS ID start>
+ *
+ * - IDs: [0, UINT_MAX - 1]
+ * - range: [1, UINT_MAX], where range == UINT_MAX requires both ID ranges to start at 0,
+ * which then means this is an init host NS mapping (and that's ok)
+ *
+ * The formula itself would be enough to "validate" a matching NS ID, but we don't want to
+ * keep parsing a malformed map file, no matter how unlikely/impossible it is to happen.
+ * Same reason values are parsed as 'unsigned long long', so we can check for bogus data.
+ */
+ id = UINT_MAX;
+ errno = ENODATA;
+ while (fscanf(fp, "%llu %llu %llu", &ns_start, &host_start, &range) == 3) {
+ if (ns_start >= UINT_MAX || host_start >= UINT_MAX ||
+ range > UINT_MAX || range == 0) {
+ errno = EINVAL;
+ ret = 1;
+ break;
+ }
- errno = ENODATA;
- if ((!uidp || strncmp(buf, "Uid:", 4)) && (!gidp || strncmp(buf, "Gid:", 4)))
- continue;
+ if (range == UINT_MAX && (ns_start != 0 || host_start != 0)) {
+ errno = EINVAL;
+ ret = 1;
+ break;
+ }
- errno = 0;
+ if (host_start + range > UINT_MAX || ns_start + range > UINT_MAX) {
+ errno = EINVAL;
+ ret = 1;
+ break;
+ }
/*
- * Example line format (same for both Uid/Gid):
- * "Uid:\t%u\t%u\%u\%u"
+ * Check if host ID fits this line.
+ * Our desired NS ID may be in any line of the file.
*
- * Where the numbers represents:
- * <real> <effective> <saved> <fsuid>
+ * Note: new{uid,gid}map tools (that creates the map files) don't allow multiple
+ * maps (NS IDs) to the same host ID.
*
- * We're only interested in the <real> value.
+ * If we get a match here, we'll save it, but we continue parsing the file.
+ * If we happen to find a duplicate, it's possible this is a rogue file trying to
+ * bypass these checks.
*
- * (field names "Uid:"/"Gid:" parsed above, skip it)
+ * In such cases, discard the match and return EOPNOTSUPP, as returning a
+ * successful match could lead to disastrous results.
*/
- ret = sscanf(&buf[0] + 4, "%llu", &val);
- if (ret != 1) {
- ret = -1;
- if (errno)
+ if (*idp >= host_start && *idp < host_start + range) {
+ /* This means we found a duplicate */
+ if (!ret) {
+ ret = 1;
+ errno = EOPNOTSUPP;
+ syslog(LOG_ERR, "%s has multiple mapped IDs for %u (unsupported)",
+ map, *idp);
break;
- continue;
- }
+ }
- ret = -1;
- if (val >= UINT_MAX) {
- errno = EINVAL;
- break;
- }
-
- if (uidp && !strncmp(buf, "Uid:", 4))
- *uidp = (uid_t)val;
- else
- *gidp = (gid_t)val;
-
- if ((!uidp || *uidp != INVALID_UIDGID) && (!gidp || *gidp != INVALID_UIDGID)) {
- errno = 0;
+ id = (*idp - host_start) + ns_start;
ret = 0;
- break;
+ errno = 0;
}
}
+
+ /* This means errno was reset by fscanf() without finding anything */
+ if (ret && errno == 0)
+ errno = ENODATA;
out:
- if (fp)
+ if (fp) {
+ int err = errno;
+
fclose(fp);
+ /* Ignore fclose() errors */
+ errno = err;
+ }
+ if (!ret) {
+ *idp = id;
+ errno = 0;
+ } else {
+ syslog(LOG_DEBUG, "%s(pid=%d, map=%s, id=%u): %s", __func__, pid, map, *idp,
+ strerror(errno));
+ }
+
+ return ret;
+}
+
+/*
+ * map_uidgid() - Map (real) UID/GID from init host NS to user NS.
+ * @pid: host NS PID
+ * @uidp: (in) host UID, (out) NS UID
+ * @gidp: (in) host GID, (out) NS GID
+ *
+ * Parse /proc/@pid/{uid,gid}_map files to get NS UID/GID values.
+ * Since @pid is expected to be a host NS PID, this must be called before switching namespaces.
+ *
+ * Note: we can't use /proc/self here because we haven't switched NS yet, so {uid,gid}_map files
+ * would contain host NS values.
+ *
+ * Return: 0 on success, 1 otherwise (errno set).
+ */
+static int map_uidgid(pid_t pid, uid_t *uidp, gid_t *gidp)
+{
+ uid_t orig_uid;
+ gid_t orig_gid;
+ int ret = 1;
+
+ errno = EINVAL;
+ if (!uidp || !gidp)
+ goto out;
+
+ orig_uid = *uidp;
+ orig_gid = *gidp;
+
+ ret = map_id(pid, "uid_map", uidp);
if (ret) {
- syslog(LOG_DEBUG, "%s(pid=%d): %s", __func__, pid, strerror(errno));
- if (uidp)
- *uidp = INVALID_UIDGID;
-
- if (gidp)
- *gidp = INVALID_UIDGID;
+ if (errno == ENODATA)
+ syslog(LOG_ERR, "UID %u not mapped in this namespace (unsupported)",
+ orig_uid);
+ goto out;
}
+ ret = map_id(pid, "gid_map", gidp);
+ if (ret && errno == ENODATA)
+ syslog(LOG_ERR, "GID %u not mapped in this namespace (unsupported)",
+ orig_gid);
+out:
+ if (ret && errno != ENODATA)
+ syslog(LOG_ERR, "%s: %s", __func__, strerror(errno));
+ else if (!ret)
+ syslog(LOG_DEBUG, "host %u:%u -> NS %u:%u", orig_uid, orig_gid, *uidp, *gidp);
+
return ret;
}
@@ -1534,6 +1587,7 @@ int main(const int argc, char *const argv[])
const char *oid;
uid_t uid;
gid_t gid;
+ struct passwd *pw;
char *keytab_name = NULL;
char *env_cachename = NULL;
krb5_ccache ccache = NULL;
@@ -1680,12 +1734,52 @@ int main(const int argc, char *const argv[])
goto out;
}
+ /*
+ * 'uid' always points to a host UID, so we must get the corresponding host GID.
+ * It's safe to call getpwuid() here because we're still on host NS, i.e. caller
+ * application has no control over custom NSS modules.
+ *
+ * FIXME: if UID is from another NS, or a subuid, this will fail on mount.
+ */
+ errno = 0;
+ pw = getpwuid(uid);
+ if (!pw) {
+ syslog(LOG_ERR, "failed to retrieve GID from UID %u: %s", uid,
+ strerror(errno ? errno : ENOENT));
+ rc = 1;
+ goto out;
+ }
+
+ gid = pw->pw_gid;
+
+ /*
+ * We can't reasonably do this for root. When mounting a DFS share,
+ * for instance we can end up with creds being overridden, but the env
+ * variable left intact.
+ *
+ * Always check this before NS UID mapping.
+ */
+ if (uid == 0)
+ env_probe = false;
+
/*
* Change to the process's namespace. This means that things will work
* acceptably in containers, because we'll be looking at the correct
* filesystem and have the correct network configuration.
*/
if (arg->upcall_target == UPTARGET_APP || arg->upcall_target == UPTARGET_UNSPECIFIED) {
+ /*
+ * Map host 'uid' and 'gid' to the target user NS.
+ *
+ * Any scenario that involves unmapped UIDs or primary GIDs is not supported -- we
+ * don't have, and can't find, all the info that would be necessary to find a
+ * UID/GID within all the possible NS combinations.
+ */
+ if (!in_same_user_ns(arg->pid, getpid())) {
+ rc = map_uidgid(arg->pid, &uid, &gid);
+ if (rc)
+ goto out;
+ }
syslog(LOG_INFO, "upcall_target=app, switching namespaces to application thread");
arg->upcall_target = UPTARGET_APP;
rc = switch_to_process_ns(arg->pid);
@@ -1700,25 +1794,6 @@ int main(const int argc, char *const argv[])
syslog(LOG_INFO, "upcall_target=mount, not switching namespaces to application thread");
}
- /*
- * We can't reasonably do this for root. When mounting a DFS share,
- * for instance we can end up with creds being overridden, but the env
- * variable left intact.
- */
- if (uid == 0)
- env_probe = false;
-
- /*
- * FIXME: this only works if we haven't switched PID namespaces.
- * If we did, /proc/arg->pid/ might not exist, or worse, point to something else.
- */
- rc = get_uidgid(arg->pid, &uid, &gid);
- if (rc) {
- syslog(LOG_ERR, "get_uidgid (NS): %s", strerror(errno));
- rc = 1;
- goto out;
- }
-
rc = setgid(gid);
if (rc) {
syslog(LOG_ERR, "setgid: %s", strerror(errno));
--
2.55.0

82
cifscreds-fix-parsing-of-commands-and-parameters.patch
View File

@ -1,82 +0,0 @@
From 828cb25224cd88b3599d5ca79a7c9435491896db Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@manguebit.org>
Date: Tue, 25 Nov 2025 16:30:27 -0300
Subject: [PATCH 1/2] cifscreds: fix parsing of commands and parameters
Fix the parsing of '--username' and '--timeout' options as both
require an argument by fixing the value passed in @optstring when
calling getopt_long(3).
Also fix the matching of commands by breaking the loop when an exact
match is found. Otherwise `cifscreds clear ...` would return
"Ambiguous command" due to "clearall" command.
* Before patch
$ ./cifscreds add -u testuser w22-root2.zelda.test
error: Could not resolve address for testuser
$ ./cifscreds add -u testuser -d ZELDA
Password:
$ grep 'cifs:[ad]' /proc/keys
198de7a1 I--Q--- 1 perm 0d0d0000 0 0 logon cifs:d:testuser: 13
^^ wrong desc
$ ./cifscreds clear -u testuser w22-root2.zelda.test
Ambiguous command
$ ./cifscreds clear -u testuser -d ZELDA
Ambiguous command
* After patch
$ ./cifscreds add -u testuser w22-root2.zelda.test
Password:
$ ./cifscreds add -u testuser -d ZELDA
Password:
$ grep 'cifs:[ad]' /proc/keys
089183a9 I--Q--- 1 perm 0d0d0000 0 0 logon cifs:a:192.168.124.32: 17
0ca5ed80 I--Q--- 1 perm 0d0d0000 0 0 logon cifs:d:ZELDA: 17
$ ./cifscreds clear -u testuser w22-root2.zelda.test
$ ./cifscreds clear -u testuser -d ZELDA
Reported-by: Xiaoli Feng <xifeng@redhat.com>
Reported-by: Jay Shin <jaeshin@redhat.com>
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Cc: Steve French <smfrench@gmail.com>
Cc: linux-cifs@vger.kernel.org
---
cifscreds.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/cifscreds.c b/cifscreds.c
index 295059f9683d..e8713be23d71 100644
--- a/cifscreds.c
+++ b/cifscreds.c
@@ -71,7 +71,7 @@ static struct command commands[] = {
static struct option longopts[] = {
{"username", 1, NULL, 'u'},
{"domain", 0, NULL, 'd' },
- {"timeout", 0, NULL, 't' },
+ {"timeout", 1, NULL, 't' },
{NULL, 0, NULL, 0}
};
@@ -477,7 +477,7 @@ int main(int argc, char **argv)
if (argc == 1)
return usage();
- while((n = getopt_long(argc, argv, "dut:", longopts, NULL)) != -1) {
+ while((n = getopt_long(argc, argv, "du:t:", longopts, NULL)) != -1) {
switch (n) {
case 'd':
arg.keytype = (char) n;
@@ -507,7 +507,7 @@ int main(int argc, char **argv)
if (cmd->name[n] == 0) {
/* exact match */
best = cmd;
- continue;
+ break;
}
/* partial match */
--
2.51.1

34
docs-update-echo_interval-description.patch
View File

@ -1,34 +0,0 @@
From b9680e868d4bdf9337e542b08a559e9ca5ea6cc0 Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@manguebit.org>
Date: Tue, 25 Nov 2025 17:54:04 -0300
Subject: [PATCH 2/2] docs: update echo_interval description
It is '3 * echo_interval' since upstream commit f2caf901c1b7 ("cifs:
Fix a race condition with cifs_echo_request").
Reported-by: Alexandros Panagiotou <apanagio@redhat.com>
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Cc: Steve French <smfrench@gmail.com>
Cc: linux-cifs@vger.kernel.org
---
mount.cifs.rst | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mount.cifs.rst b/mount.cifs.rst
index d4890706a0fe..4b6d47447c0e 100644
--- a/mount.cifs.rst
+++ b/mount.cifs.rst
@@ -483,8 +483,8 @@ echo_interval=n
sets the interval at which echo requests are sent to the server on an
idling connection. This setting also affects the time required for a
connection to an unresponsive server to timeout. Here n is the echo
- interval in seconds. The reconnection happens at twice the value of the
- echo_interval set for an unresponsive server.
+ interval in seconds. The reconnection happens at three times the
+ value of the echo_interval set for an unresponsive server.
If this option is not given then the default value of 60 seconds is used.
The minimum tunable value is 1 second and maximum can go up to 600 seconds.
--
2.51.1

2
sources
View File

@ -1 +1 @@
SHA512 (cifs-utils-7.4.tar.bz2) = 36fb64ed531e983752be243be488392ba52c3797ac638147a75998b8965448009e95d7ccda187c7d50d753b0ddb87a464a83044064b099d49fffe03a0b6ba739
SHA512 (cifs-utils-7.6.tar.bz2) = 000bca9eb0242c8c04dc1110244ad26cd39f11541cc038e36a1b36c2e683fde19d61a59234e0e592bf8d83ebebafb4d46a7e6978c745bba5e3e155e05908dcbc