aboutsummaryrefslogtreecommitdiff
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* posix_spawn: use rfork_thread on all archesKonstantin Belousov36 hours1-21/+18
| | | | | | | | | Do not allocate or switch to the custom stack on non-x86. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54898
* libsys, libc: provide rfork_thread() and pdrfork_thread() on all archesKonstantin Belousov36 hours10-10/+86
| | | | | | | Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54898
* libc: Don't use uninitialised string for getnetbyaddr[_r](0) DNS lookupJessica Clarke40 hours1-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | If net is all-zero, the loop to extract all leading non-zero octets will iterate zero times and leave nn with the value 4, which the following switch statement to initialise qbuf does not handle. As a result, _dns_getnetbyaddr will look up the PTR record for this uninitialised string, which will leak the pre-existing contents of that stack memory to the DNS resolver and, if remote and not otherwise protected, network. Note that _dns_getnetbyaddr is only used if nsswitch.conf is configured to enable the "dns" source for the "networks" database, which is not the default configuration in FreeBSD. For glibc this same bug, in code also derived from BIND's, was issued CVE-2026-0915. This commit adopts the same behaviour as glibc's fix, which is to regard a net of 0 as being for 0.0.0.0. Apparently NetBSD will return NS_UNAVAIL instead, which may or may not make more sense, but in general glibc compatibility tends to cause less friction when there's not a good reason to avoid it. Reviewed by: markj (secteam) Fixes: 1363f04ce1b8 ("get* rework and new bind code") MFC after: 1 day Security: Same bug as glibc's CVE-2026-0915
* btree/bt_seq.c: Fix two NULL pointer dereferencesBojan Novković45 hours1-4/+4
| | | | | | | | | | | | | | | | This change fixes two NULL pointer dereferences caused by the __bt_first function. The first was caused by returning 0 (i.e., RET_SUCCESS) when a key was not found, causing the caller to dereference an uninitalized or NULL pointer. The second one was caused by an if statment clobbering a local variable with a function call result that might be NULL. Reported by: clang-tidy Sponsored by: Klara, Inc. Reviewed by: markj Obtained from: https://github.com/apple-oss-distributions/libc (partially) Differential Revision: https://reviews.freebsd.org/D54905
* btree/bt_split.c: Fix a misaligned if statementBojan Novković2 days1-1/+1
| | | | Sponsored by: Klara, Inc.
* libc: document posix_spawnattr_{get,set}procdescp_np(3)Konstantin Belousov3 days3-0/+98
| | | | | | | Reviewed by: asomers Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54899
* METALOG: Order keyword entriesJose Luis Duran3 days1-3/+3
| | | | | | | | | | | To facilitate comparison with mtree -C generated output, keep the keywords ordered. No functional change intended. Reviewed by: imp MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D54872
* posix_spawnattr_getexecfd_np.3: add closing .FcKonstantin Belousov3 days1-0/+1
| | | | | | Fixes: 9bf69c37f43e96292e97e41bf942d7aca4101362 Sponsored by: The FreeBSD Foundation MFC after: 1 week
* libc: add posix_spawnattr_{get,set}procdescp_npKonstantin Belousov3 days2-5/+51
| | | | | | | Reviewed by: asomers Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54879
* libsys: add pdrfork_thread() on x86Konstantin Belousov3 days6-2/+195
| | | | | | | Reviewed by: asomers Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54879
* kqueue.2: Fix reference to unexisting kevent1()Artem Bunichev4 days1-4/+4
| | | | | | | | | | | | kqueue1() was meant. While here, make the wording in the AUTHORS section more clear. PR: 291908 Fixes: 9b1585384d53 ("kqueue.2: Editorial pass") Reviewed by: kib, dab MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D54858
* libc: document posix_spawnattr_getexecfd_np(3)Konstantin Belousov4 days3-0/+90
| | | | | | | Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54862
* libc: add posix_spawnattr_{get,set}execfd_np(3)Konstantin Belousov4 days2-1/+26
| | | | | | | | | | If execfd is set, the fexecve(2) is used by posix_spawn() instead of the provided path. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54862
* Regen syscall tables after pdfork(2) and pdwait(2) additionsKonstantin Belousov4 days2-0/+8
|
* Regen for the fork and exit/wait exterror category additionKonstantin Belousov4 days1-0/+2
|
* Document pdrfork(2) and pdwait(2)Konstantin Belousov4 days4-10/+87
| | | | | | | Reviewed by: asomers, markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54592
* lib/libsys, lib/libc: export pdwaitKonstantin Belousov4 days6-0/+42
| | | | | | | | | | Make pdwait(2) cancellable, same as all other wait*(2) syscalls wrappers. Reviewed by: asomers, markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54592
* lib/libsys, lib/libc: export pdrfork(2)Konstantin Belousov4 days1-0/+4
| | | | | | | | Reviewed by: asomers, markj Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54592
* xdr_string: don't leak strings with xdr_freeBrooks Davis6 days1-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | Historically (and in a small amount of older software such as OpenAFS), developers would attempt to free XDR strings with xdr_free((xdrproc_t)xdr_string, &string) This resulted in xdr_free calling xdr_string with only two intentional arguments and whatever was left in the third argument register. If the register held a sufficently small number, xdr_string would return FALSE and not free the string (no one checks the return values). Software should instead free strings with: xdr_free((xdrproc_t)xdr_wrapstring, &string) Because buggy software exists in the wild, act as though xdr_wrapstring was used in the XDR_FREE case and plug these leaks. Reviewed by: kib MFC after: 3 days Effort: CHERI upstreaming Sponsored by: Innovate UK Differential Revision: https://reviews.freebsd.org/D54825
* rpc/xdr.h: make xdrproc_t always take two argumentsBrooks Davis6 days1-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The type of xdrproc_t is clearly defined in the comments as a function with two arguments, an XDR * and a void * (sometimes spelled caddr_t). It was initialy defined as: typedef bool_t (*xdrproc_t)(); At some point people started giving it a non-empty argument list. Unfortunatly, there has been widespread disagreement about how arguments are passed. There seems to have been a widespread view that it should be allowed to pass three argument function pointer to xdrproc_t. Most notable is xdr_string which takes a maximum length parameter. This lead to all sorts of prototypes (all of which have been present in the FreeBSD source tree): FreeBSD userspace (nominally from tirpc, but seemingly local): typedef bool_t (*xdrproc_t)(XDR *, ...); FreeBSD kernel, glibc: typedef bool_t (*xdrproc_t)(XDR *, void *, ...); rcp/xdr.h with _KERNEL defined (not used?): typedef bool_t (*xdrproc_t)(XDR *, void *, u_int); gssrpc (in krb5) and Linux kernel: typedef bool_t (*xdrproc_t)(XDR *, void *); For two argument functions on current ABIs, these all equivalent as these arguments are passed in registers regardless of decleration and definition, but we end up with two problems: - xdr_free((xdrproc_t)xdr_string, ...) calls xdr_string with no third argument and (at least on FreeBSD) may fail to free memory if the string is shorter than the value lying around in the third argument register. There are no instance of this in tree, but I found some with Debian code search, in particular in OpenAFS. - Under CheriABI, variadic arguments are passed in a separate, bounded array so theses prototypes aren't equilvalent to the non-variadic calling convention of the functions. The reality is that that xdr_string should not be cast to xdrproc_t and xdr_wrapstring should be used instead so we do not need to support this case. Instances of the former behavior are now extremely rare. With this change we bring FreeBSD in line with gssrpc and the Linux Kernel. Warnings about casts should now be correct and should be fixed. Bump __FreeBSD_version as some software required adaptation if it is declaring functions to cast to xdrproc_t. Update OpenZFS's workaround of this historic mess accordingly. Effort: CHERI upstreaming Sponsored by: Innovate UK Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D54824
* libiconv: Fix typo in commentEd Maste7 days1-1/+1
|
* libfetch: allow disabling TLS v1.3 when the connectionEugene Grosbein7 days2-4/+10
| | | | MFC after: 3 days
* libfetch: apply timeout to SSL_read()Eugene Grosbein7 days1-0/+8
| | | | | | | Currently, fetchTimeout works for non-SSL connections only, so does fetch -T. Fix it applying specified timeout to SSL_read(). MFC after: 3 days
* socket.2: Cross-reference protocol familiesArtem Bunichev8 days1-27/+110
| | | | | | | | | While here, make wider use of Dv for socket types and protocol families and reference fcntl(2) flags for the `type` argument values. MFC after: 3 days Reviewed by: glebius, ziaee Differential Revision: https://reviews.freebsd.org/D54434
* cron: Implement full PAM session lifecycle for user jobsXin LI8 days1-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Extend PAM integration beyond account checks to include credential establishment and session management, allowing PAM modules to configure the execution environment for user cron jobs. Previously, cron only called pam_acct_mgmt() to verify account validity but immediately terminated the PAM handle before job execution. This prevented PAM modules from establishing sessions, setting credentials (e.g., Kerberos tickets), or exporting environment variables needed by jobs. The PAM handle now persists in the intermediate process throughout the job execution, enabling proper session open/close pairing. Credentials are established and sessions opened while still running as root, before dropping privileges in the grandchild. PAM environment variables are exported in the job process with user crontab variables taking precedence. A session rule (pam_permit.so) is added to /etc/pam.d/cron to enable session support without changing default behavior. Administrators can replace this with other modules as needed. System crontab entries continue to bypass all PAM operations. PR: bin/244844 Reviewed by: des MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D54415
* krb5: Expose missing symbolsCy Schubert9 days2-0/+2
| | | | | | | | | | | | | | | | | | | | | Add symbols found in the port but not in base. This requires replacing a shared libkrb5profile.so with libkrb5profile.a (with -fPIC so it can be used by shared libraries). We do this by making libkrb5profile INTERNALLIB. Base currently has libkrb5profile in a shared library. The patch moves those functions to the various "consumer" libraries as the port does. Symbols that should be in the other libraries are in libkrb5profile.so. This is causing some ports issues. PR: 291695 Reported by: michaelo, markj, Chris Inacio <inacio@andrew.cmu.edu> Tested by: michaelo Fixes: ae07a5805b19 Reviewed by: michaelo (previous version) MFC after: 2 weeks Differential revision: https://reviews.freebsd.org/D54323
* jail(3): fix common usage after mac.label supportKyle Evans9 days3-7/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Nobody else's mac.conf(5) has any entries for jails, so they get a trivial ENOENT and we fail before we can fetch any jail parameters. Most notably, this breaks `jls -s` / `jls -n` if you do not have any loaded policy that applies jail labels. Add an entry that works for everyone, and hardcode that as an ENOENT fallback in libjail to provide a smoother transition. This is probably not harmful to leave in long-term, since mac.conf(5) will override it. This unearthed one additional issue, in that mac_get_prison() in the MAC framework handled the no-label-policies bit wrong. We don't want to break jail utilities enumerating jail parameters automatically, so we must ingest the label in all cases -- we can still use it as a small optimization to avoid trying to copy out any label. We will break things if a non-optional element is specified in the copied in label, but that's expected. The APIs dedicated to jaildescs remain unphased, since they won't be used in the same way. Fixes: db3b39f063d9f05 ("libjail: extend struct handlers [...]") Fixes: bd55cbb50c58876 ("kern: add a mac.label jail parameter") Reported by: jlduran (on behalf of Jenkins) Reviewed by: jlduran Differential Revision: https://reviews.freebsd.org/D54786
* lib/libthr: add pthread_tryjoin(3) testKonstantin Belousov10 days2-0/+63
| | | | | | | Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54766
* libthr: add pthread_tryjoin_np()Konstantin Belousov10 days2-14/+45
| | | | | | | | | Similar to the same glibc function. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54766
* libthr/thread/thr_join.c: deduplicate backout_join() helperKonstantin Belousov10 days1-8/+13
| | | | | | | Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D54766
* libc: drop NO_FP_LIBC supportXin LI12 days10-75/+0
| | | | | | | | | | | NO_FP_LIBC was added in 2004 to save space by disabling FP support in *printf()/*scanf(). The size benefit is negligible on modern systems and conflicts with assumptions made by current base utilities. Remove the option and always build libc with floating-point support. Reported by: Oskar Holmlund <eovholmlund at gmail com> MFC after: 2 weeks
* tdestroy: don't visit one-child node twiceDoug Moore13 days1-34/+32
| | | | | | | | | Change tdestroy() to immediately free a node with no right child as soon as it is encountered. Currently, such nodes are visited twice before deletion. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D54699
* exterr: Regenerate exterr_cat_filenames.hMark Johnston13 days1-1/+1
|
* lib/virtual_oss: don't (over)link to libsamplerateBrooks Davis13 days5-11/+4
| | | | | | | | | | | These plugins require samplerate.h due to virtual_oss's int.h including it, but don't use any symbols directly so don't link to the library. Centralize adding the include path. Reviewed by: christos Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D54705
* virtual_oss: build system tidyingBrooks Davis13 days6-18/+9
| | | | | | | | | | | | | | | | | | general: - find libsamplerate's headers in the temporary sysroot instead of digging in the source tree. - use LIBADD where possible lib/virtual_oss: - centralize SHLIBDIR define - centralize include path for internal headers - don't try to find libsamplerate directly in .OBJDIR No functional changes. Reviewed by: christos Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D54704
* virtual_oss: build commands/libs in parallelBrooks Davis13 days1-0/+2
| | | | | | Reviewed by: christos Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D54703
* virtual_oss: remove needless .include in intermediate MakefileBrooks Davis13 days1-1/+0
| | | | | | | | It doesn't define anything we use. Reviewed by: christos Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D54702
* libjail: extend struct handlers to included MAC labelsKyle Evans14 days1-3/+189
| | | | | | | | | | | | | | | | MAC label handling is a little special; to avoid being too disruptive, we allocate a `mac_t *` here for the value so that we can mac_prepare() or mac_from_text() into. As a result, we need: - A custom free() handler to avoid leaking the *jp_value - A custom jailparam_get() handler to mac_prepare() the mac_t and populate the iove properly, so that the kernel doesn't have to do something funky like copyin, dereference, copyin again. - A custom jailparam_set() handler to similarly populate the iovec properly. Reviewed by: jamie Differential Revision: https://reviews.freebsd.org/D53960
* libjail: start refactoring struct ioctl supportKyle Evans14 days1-57/+149
| | | | | | | | | | | Instead of ad-hoc comparisons against the struct type in a few places, start to abstract out an interface for dealing with struct types. For now, this just means that we have some special jailparam_import and jailparam_export handling for the ip addr types, but in the next commit we'll extend it further to support MAC labels. Reviewed by: jamie Differential Revision: https://reviews.freebsd.org/D53959
* virtual_oss: Take MK_CUSE into accountChristos Margiolis14 days1-1/+1
| | | | | | | | | Reported by: brooks Fixes: f74f891581bc ("src.opts: Introduce MK_SOUND") Sponsored by: The FreeBSD Foundation MFC after: 4 days Reviewed by: brooks, emaste Differential Revision: https://reviews.freebsd.org/D54708
* libc/stdlib: Port strtonumx() from IllumosHans Rosenfeld2026-01-154-23/+80
| | | | | | | | | | | Add strtonumx(), a companion to strtonum(3) that preserves its safety and error-reporting semantics while allowing the caller to specify a conversion base, similar to the strtol(3) family of functions. Reviewed by: emaste, kib, ziaee Obtained from: https://www.illumos.org/issues/15365 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D54270
* ncurses: fix cross build on MacOSBaptiste Daroussin2026-01-151-1/+0
|
* swab: Correctly treat the data as misalignedJohn Baldwin2026-01-141-3/+10
| | | | | | | | | | | | | | | | | | | | | The __aligned attribute in the previous version applied to the location of the pointers, not the data the pointers pointed to. While this could be fixed by applying the attribute to a local typedef of uint16_t, just using memcpy() for the unaligned access is simpler and ISO C. This fixes the build on CHERI architectures which do not support misaligned pointers and were thus failing with: lib/libc/string/swab.c:12:18: error: alignment (1) of 'const uint16_t *' (aka 'const unsigned short *') is less than the required capability alignment (16) [-Werror,-Wcheri-capability-misuse] 12 | const uint16_t *f __aligned(1) = from; | Co-authored by: Jessica Clarke <jrtc27@FreeBSD.org> Fixes: 02ebbc781f08 ("swab: Fix implementation to support overlapping copies") Sponsored by: AFRL, DARPA Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D54399
* libexecinfo: tests: Expect failure on aarch64Jose Luis Duran2026-01-141-0/+8
| | | | | | | | | Add a guard that expects a failure of the test on aarch64. Reviewed by: emaste Fixes: df1ea5887326 ("tests: Test libexecinfo backtrace call througth signal trampoline") MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D54675
* ncurses: merge update to ncurses 6.6Baptiste Daroussin2026-01-142-22/+24
| | | | | | | 6.6 is ABI compatible with 6.5 (tested with abidiff) Remove html documentation to ease updates MFC After: 1 month
* pf: configurable action on limiter exceededKristof Provost2026-01-142-6/+16
| | | | | | | | | | | | | | | | This change extends pf(4) limiters so administrator can specify action the rule executes when limit is reached. By default when limit is reached the limiter overrides action specified by rule to no-match. If administrator wants to block packet instead then rule with limiter should be changed to: pass in from any to any state limiter test (block) OK dlg@ Obtained from: OpenBSD, sashan <sashan@openbsd.org>, 04394254d9 Sponsored by: Rubicon Communications, LLC ("Netgate")
* pf: convert state limiter interface to netlinkKristof Provost2026-01-142-0/+413
| | | | | | | This is a new feature with new ioctl calls, so we can safely remove them right now. Sponsored by: Rubicon Communications, LLC ("Netgate")
* pf: introduce source and state limitersKristof Provost2026-01-142-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | both source and state limiters can provide constraints on the number of states that a set of rules can create, and optionally the rate at which they are created. state limiters have a single limit, but source limiters apply limits against a source address (or network). the source address entries are dynamically created and destroyed, and are also limited. this started out because i was struggling to understand the source and state tracking options in pf.conf, and looking at the code made it worse. it looked like some functionality was missing, and the code also did some things that surprised me. taking a step back from it, even it if did work, what is described doesn't work well outside very simple environments. the functionality i'm talking about is most of the stuff in the Stateful Tracking Options section of pf.conf(4). some of the problems are illustrated one of the simplest options: the "max number" option that limits the number of states that a rule is allowed to create: - wiring limits up to rules is a problem because when you load a new ruleset the limit is reset, allowing more states to be created than you intended. - a single "rule" in pf.conf can expand to multiple rules in the kernel thanks to things like macro expansion for multiple ports. "max 1000" on a line in pf.conf could end up being many times that in effect. - when a state limit on a rule is reached, the packet is dropped. this makes it difficult to do other things with the packet, such a redirect it to a tarpit or another server that replies with an outage notices or such. a state limiter solves these problems. the example from the pf.conf.5 change demonstrates this: An example use case for a state limiter is to restrict the number of connections allowed to a service that is accessible via multiple protocols, e.g. a DNS server that can be accessed by both TCP and UDP on port 53, DNS-over-TLS on TCP port 853, and DNS-over-HTTPS on TCP port 443 can be limited to 1000 concurrent connections: state limiter "dns-server" id 1 limit 1000 pass in proto { tcp udp } to port domain state limiter "dns-server" pass in proto tcp to port { 853 443 } state limiter "dns-server" a single limit across all these protocols can't be implemented with per rule state limits, and any limits that were applied are reset if the ruleset is reloaded. the existing source-track implementation appears to be incomplete, i could only see code for "source-track global", but not "source-track rule". source-track global is too heavy and unweildy a hammer, and source-track rule would suffer the same issues around rule lifetimes and expansions that the "max number" state tracking config above has. a slightly expanded example from the pf.conf.5 change for source limiters: An example use for a source limiter is the mitigation of denial of service caused by the exhaustion of firewall resources by network or port scans from outside the network. The states created by any one scanner from any one source address can be limited to avoid impacting other sources. Below, up to 10000 IPv4 hosts and IPv6 /64 networks from the external network are each limited to a maximum of 1000 connections, and are rate limited to creating 100 states over a 10 second interval: source limiter "internet" id 1 entries 10000 \ limit 1000 rate 100/10 \ inet6 mask 64 block in on egress pass in quick on egress source limiter "internet" pass in on egress proto tcp probability 20% rdr-to $tarpit the extra bit is if the source limiter doesn't have "space" for the state, the rule doesn't match and you can fall through to tarpitting 20% of the tcp connections for fun. i've been using this in anger in production for over 3 years now. sashan@ has been poking me along (slowly) to get it in a good enough shape for the tree for a long time. it's been one of those years. bluhm@ says this doesnt break the regress tests. ok sashan@ Obtained from: OpenBSD, dlg <dlg@openbsd.org>, 8463cae72e Sponsored by: Rubicon Communications, LLC ("Netgate")
* libc/aarch64: Use MOPS implementations of memcpy/memmove/memset where availbleSarah Walker2026-01-136-6/+139
| | | | | | Reviewed by: andrew Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D54560
* libc/csu: Pass HWCAP flags to ifunc resolver functionsSarah Walker2026-01-131-3/+28
| | | | | | | | | | Function arguments are based on Section 9.4.1 "GNU C Library IFUNC interface" from "System V ABI for the Arm 64-bit Architecture (AArch64)", 2025Q1. (https://github.com/ARM-software/abi-aa/releases/download/2025Q1/sysvabi64.pdf) Reviewed by: andrew Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D54599
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-29 14:12:25 +0000