Blob Blame History Raw
From 0956c8149f11921ed427d67b10bb9b6c4b97df48 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Thu, 2 Feb 2017 12:32:13 +0100
Subject: [PATCH] IPA certauth plugin

This patch add a certauth plugin which allows the IPA server to support
PKINIT for certificates which do not include a special SAN extension
which contains a Kerberos principal but allow other mappings with the
help of SSSD's certmap library.

Related to https://pagure.io/freeipa/issue/4905

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: David Kupka <dkupka@redhat.com>
---
 daemons/ipa-kdb/Makefile.am        |  24 ++-
 daemons/ipa-kdb/ipa-certauth.in    |   5 +
 daemons/ipa-kdb/ipa_kdb.c          |   2 +
 daemons/ipa-kdb/ipa_kdb.exports    |   1 +
 daemons/ipa-kdb/ipa_kdb.h          |   5 +
 daemons/ipa-kdb/ipa_kdb_certauth.c | 398 +++++++++++++++++++++++++++++++++++++
 freeipa.spec.in                    |   2 +
 server.m4                          |  13 ++
 8 files changed, 449 insertions(+), 1 deletion(-)
 create mode 100644 daemons/ipa-kdb/ipa-certauth.in
 create mode 100644 daemons/ipa-kdb/ipa_kdb_certauth.c

diff --git a/daemons/ipa-kdb/Makefile.am b/daemons/ipa-kdb/Makefile.am
index 6a2caa0637bf076c796b50efc92412062524f35f..715666e779a4fa64c2c0f71767f09efb19b5f908 100644
--- a/daemons/ipa-kdb/Makefile.am
+++ b/daemons/ipa-kdb/Makefile.am
@@ -18,6 +18,7 @@ AM_CPPFLAGS =						\
 	$(WARN_CFLAGS)					\
 	$(NDRPAC_CFLAGS)				\
 	$(NSS_CFLAGS)					\
+	$(SSSCERTMAP_CFLAGS)				\
 	$(NULL)
 
 plugindir = $(libdir)/krb5/plugins/kdb
@@ -39,6 +40,20 @@ ipadb_la_SOURCES = 		\
 	ipa_kdb_audit_as.c	\
 	$(NULL)
 
+if BUILD_IPA_CERTAUTH_PLUGIN
+ipadb_la_SOURCES += ipa_kdb_certauth.c
+
+
+%: %.in
+	sed \
+		-e 's|@plugindir@|$(plugindir)|g' \
+		'$(srcdir)/$@.in' >$@
+
+krb5confdir = $(sysconfdir)/krb5.conf.d
+krb5conf_DATA = ipa-certauth
+CLEANFILES = $(krb5conf_DATA)
+endif
+
 ipadb_la_LDFLAGS = 		\
 	-avoid-version 		\
 	-module			\
@@ -50,6 +65,7 @@ ipadb_la_LIBADD = 		\
 	$(NDRPAC_LIBS)		\
 	$(UNISTRING_LIBS)	\
 	$(NSS_LIBS)             \
+	$(SSSCERTMAP_LIBS)	\
 	$(top_builddir)/util/libutil.la	\
 	$(NULL)
 
@@ -70,6 +86,11 @@ ipa_kdb_tests_SOURCES =        \
        ipa_kdb_delegation.c    \
        ipa_kdb_audit_as.c      \
        $(NULL)
+
+if BUILD_IPA_CERTAUTH_PLUGIN
+ipa_kdb_tests_SOURCES += ipa_kdb_certauth.c
+endif
+
 ipa_kdb_tests_CFLAGS = $(CMOCKA_CFLAGS)
 ipa_kdb_tests_LDADD =          \
        $(CMOCKA_LIBS)          \
@@ -78,12 +99,13 @@ ipa_kdb_tests_LDADD =          \
        $(NDRPAC_LIBS)          \
        $(UNISTRING_LIBS)       \
        $(NSS_LIBS)             \
+       $(SSSCERTMAP_LIBS)      \
        $(top_builddir)/util/libutil.la	\
        -lkdb5                  \
        -lsss_idmap             \
        $(NULL)
 
-dist_noinst_DATA = ipa_kdb.exports
+dist_noinst_DATA = ipa_kdb.exports ipa-certauth.in
 
 clean-local:
 	rm -f tests/.dirstamp
diff --git a/daemons/ipa-kdb/ipa-certauth.in b/daemons/ipa-kdb/ipa-certauth.in
new file mode 100644
index 0000000000000000000000000000000000000000..eda89a26f02fbea449eb754b232b8115904acd21
--- /dev/null
+++ b/daemons/ipa-kdb/ipa-certauth.in
@@ -0,0 +1,5 @@
+[plugins]
+ certauth = {
+  module = ipakdb:@plugindir@/ipadb.so
+  enable_only = ipakdb
+ }
diff --git a/daemons/ipa-kdb/ipa_kdb.c b/daemons/ipa-kdb/ipa_kdb.c
index c19b7c40e2e88173ab8367a3ef1d7f46245fd174..a961e4e57cf5379eb237551d56e3bc8dc82d952d 100644
--- a/daemons/ipa-kdb/ipa_kdb.c
+++ b/daemons/ipa-kdb/ipa_kdb.c
@@ -67,6 +67,8 @@ static void ipadb_context_free(krb5_context kcontext,
         }
         free(cfg->authz_data);
 
+        ipa_certauth_free_moddata(&((*ctx)->certauth_moddata));
+
         free(*ctx);
         *ctx = NULL;
     }
diff --git a/daemons/ipa-kdb/ipa_kdb.exports b/daemons/ipa-kdb/ipa_kdb.exports
index d2c3f30246cc7ebcba02a9ec5d134e604fa0dbb9..27ce92d2edd741245061a5f4ee9275169440c932 100644
--- a/daemons/ipa-kdb/ipa_kdb.exports
+++ b/daemons/ipa-kdb/ipa_kdb.exports
@@ -3,6 +3,7 @@ EXPORTED {
 	# public symbols
 	global:
 		kdb_function_table;
+		certauth_ipakdb_initvt;
 
 	# everything else is local
 	local:
diff --git a/daemons/ipa-kdb/ipa_kdb.h b/daemons/ipa-kdb/ipa_kdb.h
index 72f2675809a3267cce30bc06c77335697c7287ad..632c1979d15e88aec86d5e408ed6c7017d8362b8 100644
--- a/daemons/ipa-kdb/ipa_kdb.h
+++ b/daemons/ipa-kdb/ipa_kdb.h
@@ -40,6 +40,7 @@
 #include <arpa/inet.h>
 #include <endian.h>
 #include <unistd.h>
+#include <krb5/certauth_plugin.h>
 
 #include "ipa_krb5.h"
 #include "ipa_pwd.h"
@@ -111,6 +112,7 @@ struct ipadb_context {
     krb5_key_salt_tuple *def_encs;
     int n_def_encs;
     struct ipadb_mspac *mspac;
+    krb5_certauth_moddata certauth_moddata;
 
     /* Don't access this directly, use ipadb_get_global_config(). */
     struct ipadb_global_config config;
@@ -331,3 +333,6 @@ ipadb_get_global_config(struct ipadb_context *ipactx);
 int ipadb_get_enc_salt_types(struct ipadb_context *ipactx, LDAPMessage *entry,
                              char *attr, krb5_key_salt_tuple **enc_salt_types,
                              int *n_enc_salt_types);
+
+/* CERTAUTH PLUGIN */
+void ipa_certauth_free_moddata(krb5_certauth_moddata *moddata);
diff --git a/daemons/ipa-kdb/ipa_kdb_certauth.c b/daemons/ipa-kdb/ipa_kdb_certauth.c
new file mode 100644
index 0000000000000000000000000000000000000000..a53a2ce4e7ceb06ec8de117cdbca2666fdb5a97a
--- /dev/null
+++ b/daemons/ipa-kdb/ipa_kdb_certauth.c
@@ -0,0 +1,398 @@
+/** BEGIN COPYRIGHT BLOCK
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Additional permission under GPLv3 section 7:
+ *
+ * In the following paragraph, "GPL" means the GNU General Public
+ * License, version 3 or any later version, and "Non-GPL Code" means
+ * code that is governed neither by the GPL nor a license
+ * compatible with the GPL.
+ *
+ * You may link the code of this Program with Non-GPL Code and convey
+ * linked combinations including the two, provided that such Non-GPL
+ * Code only links to the code of this Program through those well
+ * defined interfaces identified in the file named EXCEPTION found in
+ * the source code files (the "Approved Interfaces"). The files of
+ * Non-GPL Code may instantiate templates or use macros or inline
+ * functions from the Approved Interfaces without causing the resulting
+ * work to be covered by the GPL. Only the copyright holders of this
+ * Program may make changes or additions to the list of Approved
+ * Interfaces.
+ *
+ * Authors:
+ * Sumit Bose <sbose@redhat.com>
+ *
+ * Copyright (C) 2017 Red Hat, Inc.
+ * All rights reserved.
+ * END COPYRIGHT BLOCK **/
+
+#include <errno.h>
+//#include <krb5/certauth_plugin.h>
+#include <syslog.h>
+#include <sss_certmap.h>
+
+#include "util/ipa_krb5.h"
+#include "ipa_kdb.h"
+
+#define IPA_OC_CERTMAP_RULE "ipaCertMapRule"
+#define IPA_CERTMAP_MAPRULE "ipaCertMapMapRule"
+#define IPA_CERTMAP_MATCHRULE "ipaCertMapMatchRule"
+#define IPA_CERTMAP_PRIORITY "ipaCertMapPriority"
+#define IPA_ENABLED_FLAG "ipaEnabledFlag"
+#define IPA_TRUE_VALUE "TRUE"
+#define IPA_ASSOCIATED_DOMAIN "associatedDomain"
+
+#define OBJECTCLASS "objectClass"
+
+#define CERTMAP_FILTER "(&("OBJECTCLASS"="IPA_OC_CERTMAP_RULE")" \
+                              "("IPA_ENABLED_FLAG"="IPA_TRUE_VALUE"))"
+
+#ifndef discard_const
+#define discard_const(ptr) ((void *)((uintptr_t)(ptr)))
+#endif
+
+
+struct krb5_certauth_moddata_st {
+    char *local_domain;
+    struct sss_certmap_ctx *sss_certmap_ctx;
+    struct ipadb_context *ipactx;
+};
+
+void ipa_certmap_debug(void *private,
+                       const char *file, long line,
+                       const char *function,
+                       const char *format, ...)
+{
+    va_list ap;
+    char str[255] = { 0 };
+
+    va_start(ap, format);
+    vsnprintf(str, sizeof(str)-1, format, ap);
+    va_end(ap);
+    krb5_klog_syslog(LOG_INFO, str);
+}
+
+void ipa_certauth_free_moddata(krb5_certauth_moddata *moddata)
+{
+    if (moddata == NULL || *moddata == NULL) {
+        return;
+    }
+
+    free((*moddata)->local_domain);
+    (*moddata)->local_domain = NULL;
+    sss_certmap_free_ctx((*moddata)->sss_certmap_ctx);
+    (*moddata)->sss_certmap_ctx = NULL;
+
+    free(*moddata);
+
+    return;
+}
+
+static krb5_error_code ipa_get_init_data(krb5_context kcontext,
+                                         krb5_certauth_moddata moddata_out)
+{
+    int ret;
+    struct sss_certmap_ctx *ctx = NULL;
+    struct ipadb_context *ipactx;
+    krb5_error_code kerr;
+    char *basedn = NULL;
+    LDAPMessage *result = NULL;
+    LDAPMessage *le;
+    LDAP *lc;
+    size_t c;
+    uint32_t prio;
+    char *map_rule = NULL;
+    char *match_rule = NULL;
+    char **domains = NULL;
+
+    const char *certmap_attrs[] = { OBJECTCLASS,
+                                    IPA_CERTMAP_PRIORITY,
+                                    IPA_CERTMAP_MATCHRULE,
+                                    IPA_CERTMAP_MAPRULE,
+                                    IPA_ASSOCIATED_DOMAIN,
+                                    IPA_ENABLED_FLAG,
+                                    NULL};
+
+
+    krb5_klog_syslog(LOG_INFO, "Initializing IPA certauth plugin.");
+
+    ipactx = ipadb_get_context(kcontext);
+    if (ipactx == NULL) {
+        return KRB5_KDB_DBNOTINITED;
+    }
+
+    if (ipactx->certauth_moddata == NULL) {
+        ret = asprintf(&basedn, "cn=certmap,%s", ipactx->base);
+        if (ret == -1) {
+            return ENOMEM;
+        }
+
+        kerr = ipadb_simple_search(ipactx,basedn, LDAP_SCOPE_SUBTREE,
+                                   CERTMAP_FILTER, discard_const(certmap_attrs),
+                                   &result);
+        if (kerr != 0 && kerr != KRB5_KDB_NOENTRY) {
+            goto done;
+        }
+
+        ret = sss_certmap_init(NULL, ipa_certmap_debug, NULL, &ctx);
+        if (ret != 0) {
+            return ret;
+        }
+
+        if (kerr == KRB5_KDB_NOENTRY) {
+            ret = sss_certmap_add_rule(ctx, SSS_CERTMAP_MIN_PRIO,
+                                       NULL, NULL, NULL);
+            if (ret != 0) {
+                goto done;
+            }
+        } else {
+            lc = ipactx->lcontext;
+
+            for (le = ldap_first_entry(lc, result); le;
+                                                 le = ldap_next_entry(lc, le)) {
+                prio = SSS_CERTMAP_MIN_PRIO;
+                ret = ipadb_ldap_attr_to_uint32(lc, le, IPA_CERTMAP_PRIORITY,
+                                                &prio);
+                if (ret != 0 && ret != ENOENT) {
+                    goto done;
+                }
+
+                free(map_rule);
+                map_rule = NULL;
+                ret = ipadb_ldap_attr_to_str(lc, le, IPA_CERTMAP_MAPRULE,
+                                             &map_rule);
+                if (ret != 0 && ret != ENOENT) {
+                    goto done;
+                }
+
+                free(match_rule);
+                match_rule = NULL;
+                ret = ipadb_ldap_attr_to_str(lc, le, IPA_CERTMAP_MATCHRULE,
+                                             &match_rule);
+                if (ret != 0 && ret != ENOENT) {
+                    goto done;
+                }
+
+                if (domains != NULL) {
+                    for (c = 0; domains[c] != NULL; c++) {
+                        free(domains[c]);
+                    }
+                    free(domains);
+                    domains = NULL;
+                }
+                ret = ipadb_ldap_attr_to_strlist(lc, le, IPA_ASSOCIATED_DOMAIN,
+                                                 &domains);
+                if (ret != 0 && ret != ENOENT) {
+                    goto done;
+                }
+
+                ret = sss_certmap_add_rule(ctx, prio, match_rule, map_rule,
+                                           (const char **) domains);
+                if (ret != 0) {
+                    goto done;
+                }
+            }
+        }
+
+        ipactx->certauth_moddata = moddata_out;
+
+        if (ipactx->realm != NULL) {
+            ipactx->certauth_moddata->local_domain = strdup(ipactx->realm);
+            if (ipactx->certauth_moddata->local_domain == NULL) {
+                free(ipactx->certauth_moddata);
+                ipactx->certauth_moddata = NULL;
+                ret = ENOMEM;
+                goto done;
+            }
+        }
+
+        ipactx->certauth_moddata->sss_certmap_ctx = ctx;
+        ipactx->certauth_moddata->ipactx = ipactx;
+
+    }
+
+    ret = 0;
+
+done:
+    ldap_msgfree(result);
+    free(basedn);
+    free(map_rule);
+    free(match_rule);
+    if (domains != NULL) {
+        for (c = 0; domains[c] != NULL; c++) {
+            free(domains[c]);
+        }
+        free(domains);
+        domains = NULL;
+    }
+
+    if (ret != 0) {
+        sss_certmap_free_ctx(ctx);
+    }
+
+    return ret;
+}
+
+static krb5_error_code ipa_certauth_authorize(krb5_context context,
+                                              krb5_certauth_moddata moddata,
+                                              const uint8_t *cert,
+                                              size_t cert_len,
+                                              krb5_const_principal princ,
+                                              const void *opts,
+                                              const krb5_db_entry *db_entry,
+                                              char ***authinds_out)
+{
+    char *cert_filter = NULL;
+    char **domains = NULL;
+    int ret;
+    size_t c;
+    char *principal = NULL;
+    LDAPMessage *res = NULL;
+    krb5_error_code kerr;
+    LDAPMessage *lentry;
+
+    if (moddata == NULL) {
+        return KRB5_PLUGIN_NO_HANDLE;
+    }
+
+    if (moddata->sss_certmap_ctx == NULL) {
+        kerr = ipa_get_init_data(context, moddata);
+        if (kerr != 0) {
+            krb5_klog_syslog(LOG_ERR, "Failed to init certmapping data");
+            return KRB5_PLUGIN_NO_HANDLE;
+        }
+    }
+
+    ret = krb5_unparse_name(context, princ, &principal);
+    if (ret != 0) {
+        ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;
+        goto done;
+    }
+    krb5_klog_syslog(LOG_INFO, "Doing certauth authorize for [%s]", principal);
+
+    ret = sss_certmap_get_search_filter(moddata->sss_certmap_ctx,
+                                        cert, cert_len,
+                                        &cert_filter, &domains);
+    if (ret != 0) {
+        if (ret == ENOENT) {
+            ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;
+        }
+        goto done;
+    }
+    krb5_klog_syslog(LOG_INFO, "Got cert filter [%s]", cert_filter);
+
+    /* If there are no domains assigned the rule will apply to the local
+     * domain only. */
+    if (domains != NULL) {
+
+        if (moddata->local_domain == NULL) {
+        /* We don't know our own domain name, in general this should not
+         * happen. But to be fault tolerant we allow matching rule which
+         * do not have a domain assigned. */
+
+            ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;
+            goto done;
+        }
+
+        for (c = 0; domains[c] != NULL; c++) {
+            if (strcasecmp(domains[c], moddata->local_domain) == 0) {
+                break;
+            }
+        }
+
+        /* Our domain was not in the list */
+        if (domains[c] == NULL) {
+            ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;
+            goto done;
+        }
+    }
+
+    kerr = ipadb_fetch_principals_with_extra_filter(moddata->ipactx,
+                                                    KRB5_KDB_FLAG_ALIAS_OK,
+                                                    principal,
+                                                    cert_filter,
+                                                    &res);
+    if (kerr != 0) {
+        krb5_klog_syslog(LOG_ERR, "Search failed [%d]", kerr);
+        ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;
+        goto done;
+    }
+
+    kerr = ipadb_find_principal(context, KRB5_KDB_FLAG_ALIAS_OK, res,
+                                &principal, &lentry);
+    if (kerr == KRB5_KDB_NOENTRY) {
+        krb5_klog_syslog(LOG_INFO, "No matching entry found");
+        ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;
+        goto done;
+    } else if (kerr != 0) {
+        krb5_klog_syslog(LOG_ERR, "ipadb_find_principal failed [%d]", kerr);
+        ret = KRB5KDC_ERR_CERTIFICATE_MISMATCH;
+        goto done;
+    }
+
+    /* TODO: add more tests ? */
+
+    ret = 0;
+
+done:
+    sss_certmap_free_filter_and_domains(cert_filter, domains);
+    krb5_free_unparsed_name(context, principal);
+    ldap_msgfree(res);
+
+    return ret;
+}
+
+static krb5_error_code ipa_certauth_init(krb5_context kcontext,
+                                         krb5_certauth_moddata *moddata_out)
+{
+    struct krb5_certauth_moddata_st *certauth_moddata;
+
+    certauth_moddata = calloc(1, sizeof(struct krb5_certauth_moddata_st));
+    if (certauth_moddata == NULL) {
+        return ENOMEM;
+    }
+
+    *moddata_out = certauth_moddata;
+
+    return 0;
+}
+
+static void ipa_certauth_fini(krb5_context context,
+                              krb5_certauth_moddata moddata_out)
+{
+    krb5_klog_syslog(LOG_INFO, "IPA certauth plugin un-loaded.");
+    return;
+}
+
+
+krb5_error_code certauth_ipakdb_initvt(krb5_context context,
+                                          int maj_ver, int min_ver,
+                                          krb5_plugin_vtable vtable)
+{
+    krb5_certauth_vtable vt;
+
+    if (maj_ver != 1) {
+        return KRB5_PLUGIN_VER_NOTSUPP;
+    }
+
+    vt = (krb5_certauth_vtable) vtable;
+
+    vt->name = "ipakdb";
+    vt->authorize = ipa_certauth_authorize;
+    vt->init = ipa_certauth_init;
+    vt->fini = ipa_certauth_fini;
+    /* currently we do not return authentication indicators */
+    vt->free_ind = NULL;
+    return 0;
+}
diff --git a/freeipa.spec.in b/freeipa.spec.in
index f776b34af88cc8ccd02da0713cb6eaca161c99f5..18291a5793a6b69dcd719f42e80e1652169e5e1d 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -120,6 +120,7 @@ BuildRequires:  libtalloc-devel
 BuildRequires:  libtevent-devel
 BuildRequires:  libuuid-devel
 BuildRequires:  libsss_idmap-devel
+BuildRequires:  libsss_certmap-devel
 # 1.14.0: sss_nss_getnamebycert (https://fedorahosted.org/sssd/ticket/2897)
 BuildRequires:  libsss_nss_idmap-devel >= 1.14.0
 BuildRequires:  rhino
@@ -1164,6 +1165,7 @@ fi
 %attr(0755,root,root) %{_libexecdir}/ipa/oddjob/org.freeipa.server.conncheck
 %config(noreplace) %{_sysconfdir}/dbus-1/system.d/org.freeipa.server.conf
 %config(noreplace) %{_sysconfdir}/oddjobd.conf.d/ipa-server.conf
+%config(noreplace) %{_sysconfdir}/krb5.conf.d/ipa-certauth
 %dir %{_libexecdir}/ipa/certmonger
 %attr(755,root,root) %{_libexecdir}/ipa/certmonger/*
 # NOTE: systemd specific section
diff --git a/server.m4 b/server.m4
index 92b5cdd3a6ff90b70a9002360ff3d3aec5053392..7b2e94df91a4803849e496142788a4ed87ef487d 100644
--- a/server.m4
+++ b/server.m4
@@ -30,6 +30,19 @@ dnl -- sss_idmap is needed by the extdom exop --
 PKG_CHECK_MODULES([SSSIDMAP], [sss_idmap])
 PKG_CHECK_MODULES([SSSNSSIDMAP], [sss_nss_idmap >= 1.13.90])
 
+dnl -- sss_certmap and certauth.h are needed by the IPA KDB certauth plugin --
+PKG_CHECK_EXISTS([sss_certmap],
+                 [PKG_CHECK_MODULES([SSSCERTMAP], [sss_certmap])],
+                 [AC_MSG_NOTICE([sss_certmap not found])])
+AC_CHECK_HEADER([krb5/certauth_plugin.h],
+                [have_certauth_plugin=yes],
+                [have_certauth_plugin=no])
+AM_CONDITIONAL([BUILD_IPA_CERTAUTH_PLUGIN],
+               [test x$have_certauth_plugin = xyes -a x"$SSSCERTMAP_LIBS" != x])
+AM_COND_IF([BUILD_IPA_CERTAUTH_PLUGIN],
+           [AC_MSG_NOTICE([Build IPA KDB certauth plugin])],
+           [AC_MSG_WARN([Cannot build IPA KDB certauth plugin])])
+
 dnl ---------------------------------------------------------------------------
 dnl - Check for KRB5 krad
 dnl ---------------------------------------------------------------------------
-- 
2.12.1