aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2018-04-17smpp_smsc_conf: Fix heap-use-after-freepespin/fix-smsc-use-after-freePau Espin Pedrol1-1/+6
Fixes following error catched by enabling address sanitizer: ==20792==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b000122610 at pc 0x7f9c9c3fe063 bp 0x7ffd2e68f600 sp 0x7ffd2e68edb0 READ of size 11 at 0x60b000122610 thread T0 #0 0x7f9c9c3fe062 (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x3c062) #1 0x7f9c9beb8ee4 in talloc_strdup (/usr/lib/x86_64-linux-gnu/libtalloc.so.2+0x6ee4) #2 0x56096a7cf75b in smpp_smsc_conf src/libmsc/smpp_smsc.c:983 #3 0x56096a7cf9df in smpp_smsc_start src/libmsc/smpp_smsc.c:1015 #4 0x56096a7d4935 in smpp_openbsc_start src/libmsc/smpp_openbsc.c:785 #5 0x56096a755ad0 in main src/osmo-msc/msc_main.c:598 #6 0x7f9c9927b2e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0) #7 0x56096a756979 in _start (/home/jenkins/workspace/osmo-gsm-tester_run-prod/trial-805/inst/osmo-msc/bin/osmo-msc+0xf0979) Related: OS#3181 Change-Id: Iaf0d251c8d2912266a087ada4d20905146e08592
2018-04-17tests/msc_vlr: fix expected SS message namesVadim Yanitskiy6-92/+92
Since the I697639d8469e5dda617b27995c4a92e1f0c0bead, call independent SS messages are also supported by gsm48_pdisc_msgtype_name(). So, instead of 'NCSS:0x3b' it will return 'GSM0480_MTYPE_REGISTER'. Let's correct the expected message names. Change-Id: If9e854ee84882d104cf2ffaceb3862fda6862f19
2018-04-16cosmetic: use enum ranap_nsap_addr_enc instead of intNeels Hofmeyr3-2/+18
The only reason to use int instead of the enum was the lack of header iu_client.h when not building with Iu support. Rather use the configure result properly, include the header when Iu support is built and use the proper enum. Omit the entire iu sub-struct when building without Iu. Add LIBOSMORANAP_CFLAGS to libvlr, in order to find the iu_client.h header (now also included from gsm_data.h). Rationale: Instead of using a questionable typecast from int* to enum*, we can now use the enum member directly without needing to silence compiler warnings. Change-Id: Ic9f8bf53f4b605c166e84cd7edd90c10fe7d7a1f
2018-04-14sms_queue: fix use-after-free on 'pending'Harald Welte1-1/+1
This bug is super obvious: We cannot first call sms_pending_free(pending) and then in the next line still dereference the pending->sms_id member. This bug was introduced in January with Change-Id: I3749855fe25d9d4e37ec96b0c2bffbc692b66a78 and apparently nobody has tested any MT-SMS with asan enabled since? Change-Id: Ibf17f270cdeb8153036eda3de274dd163bbff7e6 Closes: OS#3152
2018-04-14smpp: Unset esme->acl on socket closeHarald Welte1-0/+6
We set acl->esme during _process_bind(), but we don't clear it in case the TCP connection for the ESME is dead. This leads to a stale acl->esme pointer, which we will attempt to dereference the next time a SMS is delivered to a route pointing to this acl, where it will be a heap use-after-free. This was discovered using AddressSanitizer and MSC_Tests.ttcn Closes: OS#3168 Change-Id: I1f140d7f9c7d89f200ddbcd81a8df66de69fb3e4
2018-04-12msc conn ref counts: log human readable list of conn ownersNeels Hofmeyr12-1076/+1107
Change-Id: I2a09efafbdbdde0399238f7d79feea8612605201
2018-04-12refactor VLR FSM result handlingNeels Hofmeyr21-512/+487
Instead of keeping separate enums for FSM results and translating between those and the actual 04.08 reject causes that will ultimately reach the MS, just pass enum gsm48_reject_value cause codes around everywhere. Collapse some VLR *_timeout() and *_cancel() api to just *_cancel() with a gsm48 cause arg. (Hopefully) improve a few reject causes, but otherwise just aim for more transparent decisions on which cause value is used, for future fixes of returned causes. Depends: I6661f139e68a498fb1bef10c266c2f064b72774a (libosmocore) Change-Id: I27bf8d68737ff1f8dc6d11fb1eac3d391aab0cb1
2018-04-12libmsc/ussd: don't overwrite rc if decoding failedVadim Yanitskiy1-2/+3
Change-Id: I344e4b3a9aad617686a7ddbdeae5780fd8b07e58
2018-04-11cosmetic: embed compl_l3_type in FSM idNeels Hofmeyr12-7132/+7132
In the subscr_conn_fsm instance's ID, include the Complete Layer 3 type, so that we can see on the first glance whether a state transition belongs to MO or MT. The huge patch is due to the cosmetic change affecting nearly every single log line in the msc_vlr_tests, by nature of changing the FSM's ID. Related: OS#3122 Change-Id: I2a7e27e0f16df1872dcda64cb928c3b8528ea3f7
2018-04-11fix BSC Clear RequestNeels Hofmeyr1-8/+2
On receiving a Clear Request, don't send a Clear Command "out of band", let the FSM do the release handling by invoking msc_subscr_conn_mo_close(). Fixes: ttcn3 MSC_Tests.TC_lu_clear_request Change-Id: I168b889ac7989641cc679b781dcffb87ff13a710
2018-04-11properly receive BSSMAP Clear Complete and Iu Release CompleteNeels Hofmeyr30-571/+931
When sending a BSSMAP Clear or Iu Release, do not immediately discard the conn, but wait until a BSSMAP Clear Complete / Iu Release Complete has been received. Hence we will no longer show in the log that an incoming Release/Clear Complete belongs to an unknown subscriber, but will still be around to properly log the release. Related: OS#3122 Change-Id: Ie4c6aaba3866d6e5b98004e8870a215e8cf8ffc1
2018-04-11refactor subscr_conn and subscr_conn_fsm de-/allocNeels Hofmeyr20-2922/+3565
Refactor: 1. Glue the gsm_subscriber_connection alloc to the subscr_conn_fsm. 2. Add separate AUTH_CIPH state to the FSM. 3. Use conn->use_count to trigger conn release. 4. Add separate RELEASING state to the FSM. 5. Add rate counters for each of the three Complete Layer 3 types. Details: 1. Glue the gsm_subscriber_connection alloc to the subscr_conn_fsm. Historically, a gsm_subscriber_connection was allocated in libbsc land, and only upon Complete Layer 3 did libmsc add the fsm instance. After splitting openbsc.git into a separate osmo-msc, this is no longer necessary, hence: Closely tie gsm_subscriber_connection allocation to the subscr_conn_fsm instance: talloc the conn as a child of the FSM instance, and discard the conn as soon as the FSM terminates. 2. Add separate AUTH_CIPH state to the FSM. Decoding the Complete Layer 3 message is distinctly separate from waiting for the VLR FSMs to conclude. Use the NEW state as "we don't know if this is a valid message yet", and the AUTH_CIPH state as "evaluating, don't release". A profound effect of this: should we for any odd reason fail to leave the FSM's NEW state, the conn will be released right at the end of msc_compl_l3(), without needing to trigger release in each code path. 3. Use conn->use_count to trigger conn release. Before, the FSM itself would hold a use count on the conn, and hence we would need to ask it whether it is ready to release the conn yet by dispatching events, to achieve a use_count decrement. Instead, unite the FSM instance and conn, and do not hold a use count by the FSM. Hence, trigger an FSM "UNUSED" event only when the use_count reaches zero. As long as use counts are done correctly, the FSM will terminate correctly. These exceptions: - The new AUTH_CIPH state explicitly ignores UNUSED events, since we expect the use count to reach zero while evaluating Authentication and Ciphering. (I experimented with holding a use count by AUTH_CIPH onenter() and releasing by onleave(), but the use count and thus the conn are released before the next state can initiate transactions that would increment the use count again. Same thing for the VLR FSMs holding a use count, they should be done before we advance to the next state. The easiest is to simply expect zero use count during the AUTH_CIPH state.) - A CM Service Request means that even though the MSC would be through with all it wants to do, we shall still wait for a request to follow from the MS. Hence the FSM holds a use count on itself while a CM Service is pending. - While waiting for a Release/Clear Complete, the FSM holds a use count on itself. 4. Add separate RELEASING state to the FSM. If we decide to release for other reasons than a use count reaching zero, we still need to be able to wait for the msc_dtap() use count on the conn to release. (An upcoming patch will further use the RELEASING state to properly wait for Clear Complete / Release Complete messages.) 5. Add rate counters for each of the three Complete Layer 3 types. Besides LU, also count CM Service Request and Paging Response acceptance/rejections. Without these counters, only very few of the auth+ciph outcomes actually show in the counters. Related: OS#3122 Change-Id: I55feb379e176a96a831e105b86202b17a0ffe889
2018-04-11CC: intentionally release T308 on BSSMAP Clear Request from BSCNeels Hofmeyr3-10/+4
So far we hit a running T308 during CC release when caused by a BSSMAP Clear Request, and we loudly log that as error. However, now I understand that T308 is a direct cause of the dispatch of a REL IND towards MNCC, which is used to indicate teardown to MNCC. So during _gsm48_cc_trans_free(), we first clear all timers, then invoke mncc_release_ind() which starts another timer (useful for graceful CC Release, but in this code path the intention is immediate release). Simply immediately cancel the timer again and release the conn. A separate question is whether a BSSMAP Clear Request should be less aggressive in releasing the connections; i.e. instead of calling trans_free() all around, to rather ask each transaction to "please stop soon", somehow. Related: OS#3062 Change-Id: I231fdb574a086a206321148474cbdc7ca9cf39f0
2018-04-11msc_mgcp: do not send wildcarded DLCX messagesPhilipp Maier1-5/+25
If an error on the MGW side occurs, the MSC may send out a DLCX command that contains a wildcarded endpoint name. Wildcarded DLCX commands are legal in principle but not in the context of an error on a single endpoint. Apart from that osmo-mgw is (not yet) capable to handle wildcarded DLCX command. The problem is caused by a wrong error handling. When the first (RAN) CRCX fails the error handling logic tries to perform a DLCX, but since we did not receive a specific endpoint name yet, the buffer containing the endpoint name is still initalized with the wildcarded enpoint name, but the error handler and the code that generates the DLCX is not aware of that. - Perform a check in the error handler function that checks if a DLCX can be made (a specific endpoint name is set - Correct the flags in the code that handles the first CRCX so that no DLCX is requested in the case of error Related OS#2882 Change-Id: I64c2a82016d854ad446fd49a5d76a28324e8bd4b
2018-04-11msc_mgcp.c: log endpoint name instead of pointerPhilipp Maier1-3/+3
The logtext currently logs the pointer (address) of the string variable that holds the endpoint name, rather then the endpoint name itself. - Use %s instead of %p in format string Change-Id: I01b3d07aeedd72be60361249a5bf80fbb68b7bb8
2018-04-10msc_vlr_test_call: reproduce OS#3062Neels Hofmeyr4-0/+436
A related ttcn3 test is added in Ic80646e1fba37bb6163ca3a7eead7980b4ad7a51 Related: OS#3062 Change-Id: Ice7197b48d4e163a3c4d97b559fdcd7e88c4107e
2018-04-10trans_free: drop bad assertionNeels Hofmeyr1-3/+0
I assumed that trans_free() would always be called before freeing the FSM. But the actual conn free dance that tries to make sure a release is triggered from all directions actually may run into a situation where conn->fi is NULL. The situation is described in OS#3125. For now simply drop the assert. The subscr conn and FSM dealloc will soon be glued firmly together; but I want to add a test against OS#3062 before that, and that would also hit above assertion. Related: OS#3125 OS#3062 Change-Id: I5c30e0f9545fb76615776ff6cc16b56aeb5b043a
2018-04-09libmsc/ussd.c: cosmetic: correct log level and messageVadim Yanitskiy1-1/+2
Change-Id: If6c270fae54ce79c2708c99d7762ce6ff71f43d9
2018-04-09libmsc/gsm_04_80.c: drop unused 'in_msg' argumentVadim Yanitskiy3-11/+9
It isn't used, so no need to pass it. Change-Id: I4248ebf8626d3f7f0bf273fd20cc4f64e979938b
2018-04-09ussd.h: cosmetic: use '#pragma once' include guardVadim Yanitskiy1-4/+1
Change-Id: I0e78aa946b8e6bc7c31534751b2ee5c867bfd490
2018-04-09ussd.h: cosmetic: remove useless commentVadim Yanitskiy1-2/+0
We usually put comments for functions in *.c files, while header files are usually plain listings of the API without comments. Change-Id: I6b0d1d9e1a1b1ffb71cb9905e74f6fad2333bb65
2018-04-09Permit any Sender MSISDN when sending SMS from VTYHarald Welte4-26/+32
In the old days, OsmoNITB couldn't process any SMS that wasn't between two subscribers on the same NITB. We've long re-worked the internals in order to process SMS with arbitrary sender MSISDN (e.g. from SMPP). However, the VTY command "subscriber ... sms" was never updated, it seems. Change-Id: I62b17e0a67989484415f0df2c8cb4ff1f94dbf2b Closes: OS#3151
2018-04-09DTAP: Ensure proper DLCI is used in MSC-originated DTAPHarald Welte6-4/+16
The DLCI field of the DTAP header indicates the SAPI as well as the data link (main DCCH or SACCH). We must make sure to use the correct DLCI when sending DTAP to the BSC. We achieve this by * storing the DLCI in the msgb->cb while parsing the DTAP header * storing the received DLCI (from msgb->cb) in the transaction for mobile-originated transactions * using the trans->dlci to sent msgb->cb when transmitting L3 * filling the DTAP DLCI value from msgb->cb when transmitting DTAP For MSC-originated transactions, we choose a DLCI value corresponding to the service (SAPI=0 for CC, SAPI=3 for SMS) and store that in trans->dlci. Closes: OS#3150 Change-Id: If511b20f52575054cab1346d99a8cb68d827fdbf
2018-04-05unify allocation of gsm_subscriber_connectionNeels Hofmeyr7-17/+27
The current msc_subscr_con_allocate() was in fact only used by msc_vlr_tests, while both a_iface_bssap.c and iucs.c did their own duplicate code of allocating the gsm_subscriber_connection struct. Unify. Drop the old msc_subscr_con_allocate(), instead add msc_subscr_conn_alloc(). The new function also takes via_ran and lac arguments directly. The conn allocation will soon be closely tied to the subscr_conn_fsm instance allocation, so place the new function definition alongside the other subscr_conn_fsm API, and match its naming ("conn"). Related: OS#3122 Change-Id: Ia57b42a149a43f9c370b1310e2e1f512183993ea
2018-04-03subscr_conn: store complete_layer3_type in conn, not FSM event argNeels Hofmeyr15-182/+163
Instead of jumping through hoops to pass the Complete Layer 3 operation that created this conn via FSM event dispatch parameters, put it right in the gsm_subscriber_connection struct, where it always belonged. Move definition of the enum complete_layer3_type to gsm_data.h, where gsm_subscriber_connection is defined. Introduce msc_subscr_conn_update_id() to set the complete_layer3_type of the conn as soon as a Complete Layer 3 message is received. In msc_subscr_conn_update_id(), already include an mi_string argument to prepare for an upcoming patch where the FSM will be allocated much earlier when the Mobile Identity is not known yet, and we'll also update the fi->id here. The odd logging change in the msc_vlr_tests output uncovers a wrong use of the osmo_fsm_inst_dispatch() data argument for SUBSCR_CONN_E_CN_CLOSE events: if a child FSM signals unsuccessful result, instead of the failure cause, it passed the complete_layer3_type, as requested upon FSM allocation, which was then misinterpreted as a failure cause. Now a child FSM failure will pass NULL instead, while other SUBSCR_CONN_E_CN_CLOSE events may still pass a valid cause value. Related: OS#3122 Change-Id: Iae30dd57a8861c4eaaf56999f872d4e635ba97fb
2018-04-03cosmetic: rename subscr_conn_from to complete_layer3_typeNeels Hofmeyr3-11/+11
'subscr_conn_from' could mean anything: from what, RAN type? BSS identifier? MM action? Clearly name it as the Complete Layer 3 kind it represents. Related: OS#3122 Change-Id: I6263a80e6db01c2ca48df6c58b05e2fd19347057
2018-04-03cosmetic: rename gsm_subscriber_connection->conn_fsm to ->fiNeels Hofmeyr15-53/+54
Match osmo-bsc's naming of the subscriber connection's FSM instance; 'conn->fi' makes more sense anyway than 'conn->conn_fsm'. BTW, an upcoming commit will do away with the legacy from libbsc/libmsc duality and firmly glue the conn allocation to the fi. Related: OS#3122 Change-Id: If442f2ba78d9722b1065ec30c9a13f372b6a8caa
2018-04-03cosmetic: rx_bssmap: read message type once into local varNeels Hofmeyr1-4/+6
Instead of referencing msg->l3h[0] all the time, use local variable msg_type. Related: OS#3122 Change-Id: If70c9fa00edd462d3470bded6eb2c6521e4d9234
2018-04-03test_reject_concurrency: missing assertNeels Hofmeyr2-0/+2
I broke this test during dev and saw the failure being noticed only in the next test when DTAP is expected again. Verify success right there, instead. Change-Id: Ifdde3a6fa5835203c34c40db77761f2e90c0d5ff
2018-04-02drop some dead definitions (gsm_data.h, gsup_client.c)Neels Hofmeyr2-5/+0
Change-Id: Icad01d0ad8fa68293160bc56543b9c3dcafc50bb
2018-03-30use osmo_init_logging2() with proper talloc ctxNeels Hofmeyr17-102/+150
Since the logging allocations now also show up in the root context report, some tests need adjusted talloc checks. In msc_vlr_tests, also output the number of talloc blocks before tests are started to show that the number didn't change after the tests. Change-Id: Iae07ae60230c7bab28e52b5df97fa3844778158e
2018-03-26gsup_test_client: gsupc_read_cb: fix uninitialized value 'io'Neels Hofmeyr1-3/+3
Change-Id: Idb3ca50009e25c8e10bcbd15e430caf6de18a040
2018-03-23contrib: osmo-msc.service: Depend on osmo-mgw.servicePau Espin Pedrol1-0/+1
Change-Id: Ia50eb02843bf6d145040fbe5032071a3be7b0794
2018-03-22remove empty libcommon-csNeels Hofmeyr8-60/+0
Change-Id: If6afda250986b12781ae579323985615621ed75c
2018-03-22dissolve libcommon-cs: move gsm48_* code to libmsc, drop sms_next_rp_msg_ref()Neels Hofmeyr3-70/+58
Move gsm48_* functions from common_cs.c to libmsc/gsm_04_08.c. Drop sms_next_rp_msg_ref(), it is just a bunch of bloat around "next_rp_ref++". Apply the "++" instead, in gsm_04_11.c. libcommon-cs is now empty, to be removed in subsequent commit. Change-Id: Ibc410803ce8e273b626124ab9fc934f04df3ae50
2018-03-22dissolve libcommon-cs: move gsm_network_init() to libmscNeels Hofmeyr2-43/+37
Move to libmsc/osmo_msc.c (for lack of a better place and reluctance to create an own file just for gsm_network_init()). Change-Id: I2279eee4db6f6687726bfd55841b3748d4930f15
2018-03-22dissolve libcommon-cs: mv a_reset.c to libmscNeels Hofmeyr3-1/+1
Change-Id: I2936dadf1ec91b39796b6012d5e6c5db39e0bd34
2018-03-22rename libcommon to libgsupclientNeels Hofmeyr12-13/+8
All that is left in libcommon now are the GSUP and OAP client implementations. These are duplicated in osmo-sgsn.git and make sense to remain somewhat separate from libmsc. So now they get their own little lib. Change-Id: Ic71aa119c233b6a0ae169a5b2a53819903d2be82
2018-03-22dissolve libcommon: drop gsm_data.c, move code to libmscNeels Hofmeyr6-78/+35
classmark_is_r99() is only used in gsm_04_08.c, move there as static. rrlp_mode_* is only used in msc_vty.c, move there as static. Move ran_type_names[] to msc_ifaces.c. Change-Id: I5381c72af6841829fbc65940fd7d6f4d5cf583df
2018-03-22dissolve libcommon: drop gsm_subscriber_base.c, move vlr_subscr_* to vlr.cNeels Hofmeyr3-66/+27
Change-Id: Ia69890da68b8afa8a2a4e8ab58ec5c4a4ba9d06a
2018-03-22dissolve libcommon: move talloc ctx into msc_main.c, drop talloc_ctx.cNeels Hofmeyr10-64/+31
Drop tall_bsc_ctx; in mncc_sock_init(), talloc the mncc_sock_state from gsm_network. In tests or utils, move from using an extern tall_bsc_ctx to a local root context pointer. Change-Id: I92c252be1d1e7634f1653de47d37c99d77d9501c
2018-03-22dissolve libcommon: drop debug.cNeels Hofmeyr9-158/+140
Apply more concise logging categories in each main scope. The bulk goes to msc_main.c, obviously, while tests and utils get a slimmed down bunch of logging categories. Change-Id: I969a0662ba273f3721b6820d02151b7a5b8014b8
2018-03-22dissolve libcommon: drop unused bsc_version.cNeels Hofmeyr2-31/+0
Change-Id: I23f31b1dc265d153598ee9006cae3adaf3cebd2f
2018-03-22cosmetic: msc_vty.c: use static gsmnet instead of gsmnet_from_vty()Neels Hofmeyr1-97/+24
Now that all VTY definitions are in the same file, we no longer need gsmnet_from_vty(). Just have one static struct gsm_network *gsmnet populated by msc_vty_init() and use it in all VTY functions. Change-Id: I5cb3712a4f4245feb62d42f1b041fe94de5fac1b
2018-03-22dissolve libcommon,libcommon-cs: clean up vty definitionsNeels Hofmeyr10-1499/+1356
From openbsc.git, we still have osmo-msc's VTY definitions spread across various places. Combine: - Move the go_parent_cb() and is_config_node() to msc_main.c, drop common_vty.c. - Move all of vty_interface_layer3.c into msc_vty.c. - Move all of common_cs_vty.c into msc_vty.c. - Move bsc_vty_init_extra() into msc_vty_init(). - Drop some unused definitions No functional nor cosmetic changes have been made in the moved code, plain copy-paste moving (even though the unidiff might look like edits in some places). I might have adjusted some blank lines though. Change-Id: Ia818c00ab613a19a34080b160d763b55c19f76b1
2018-03-22trans_free: tear down conn when last transaction is doneNeels Hofmeyr7-20/+23
In trans_free(), call subscr_conn_release_when_unused(), so that we are sure to clean up after the last transaction is done. This fixes an error where a conn lingered after a CC failure, because that code path forgot to trigger cleanup. Rationale: so far we were triggering the release check after each DTAP dispatch (compl_l3 and "normal" DTAP), which is sufficient for properly closed transactions. We also need a check for when a timeout clears an erratic trans. Adjust test expectation of test_call_mo_to_unknown_timeout to show that the error is now fixed. msc_vlr_test_reject_concurrency now sees an additional release checking event when the SMS transaction is done, which is expected and does not affect the test otherwise. Related: OS#2779 Change-Id: I46ff2e9b09b67e4e0d79cccf8c04936f17281fcb
2018-03-21cosmetic: gsm_04_08.c: drop unused struct gsm_laiNeels Hofmeyr1-6/+0
Change-Id: I3236841b1701dc902754d4a388c7806b0685a91e
2018-03-21cosmetic: remove unused variablePhilipp Maier1-4/+0
Change-Id: Ic19d0401557d506d104b82f88b4dcf72055d62e1
2018-03-18a_iface: If L3/DTAP returns error in COMPL L3, close SCCP connectionHarald Welte1-2/+12
It's pretty amazing that we print error messages anrd return error codes, but nobody ever looks at the error code and/or closes the connection. Let's change that. Change-Id: Iec693d8012a7816d1ded8206c2d979ac0546fb6e
2018-03-18a_iface_bssap: Treat inbound RESET as implicit RESET ACKHarald Welte1-0/+4
If both sides are sending RESET at the same time, they are not aware of each other. This leads to synchronization problems in wich the remote side is transmitting e.g. a COMPL L3 INFO after receiving a RESET ACK, but before even receiving or processing the RESET in the inverse direction. So let's treat receiving a RESET as an implicit RESET ACK to any RESET we may have sent. Change-Id: I0ae34fbb3735592bb7cffa5aaf421b14a8acc90e