]>
git.proxmox.com Git - pve-firewall.git/log
Alexandre Derumier [Thu, 15 May 2014 04:45:06 +0000 (06:45 +0200)]
only add tap rules for interface with firewall=1
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Thu, 15 May 2014 04:37:37 +0000 (06:37 +0200)]
fwtester: simplify code with ne bport zone
Dietmar Maurer [Thu, 15 May 2014 04:05:20 +0000 (06:05 +0200)]
improve error messages
Dietmar Maurer [Wed, 14 May 2014 15:31:11 +0000 (17:31 +0200)]
fwtester: add new zone 'nfwm' to simulate a non-firewalled VM
Dietmar Maurer [Wed, 14 May 2014 15:02:55 +0000 (17:02 +0200)]
fwtester: do not count ENTER/LEAVE
Dietmar Maurer [Wed, 14 May 2014 13:32:55 +0000 (15:32 +0200)]
add README for fwtester.pl
Alexandre Derumier [Tue, 13 May 2014 10:32:08 +0000 (12:32 +0200)]
fix interface in rules for host-in and host-out
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Wed, 14 May 2014 12:48:21 +0000 (14:48 +0200)]
add tests for host interface match
Dietmar Maurer [Wed, 14 May 2014 12:12:48 +0000 (14:12 +0200)]
fwtester: support dev regex with -i and -o
Dietmar Maurer [Wed, 14 May 2014 11:55:59 +0000 (13:55 +0200)]
fwtester: fix emulation - correctly set phydev_in
Dietmar Maurer [Wed, 14 May 2014 11:44:02 +0000 (13:44 +0200)]
fwtester: add counters for debugging
Dietmar Maurer [Wed, 14 May 2014 11:20:53 +0000 (13:20 +0200)]
fwtester: do not set packet default values
Alexandre Derumier [Wed, 14 May 2014 06:42:16 +0000 (08:42 +0200)]
move blacklist inside ruleset_chain_add_input_filters
make sense to only add it for IN direction and
like this, non-firewalled vms (tap|veth for now, not matching fwln+) will never check the blacklist rule
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Alexandre Derumier [Wed, 14 May 2014 06:05:26 +0000 (08:05 +0200)]
remove optimize option
new model is already optimized, no need to have tricks now
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Wed, 14 May 2014 10:14:32 +0000 (12:14 +0200)]
fwtester: implement some useful command line option
Dietmar Maurer [Wed, 14 May 2014 09:38:49 +0000 (11:38 +0200)]
fwtester: implement new 'outside' zone
To simulate traffic from/to outside world (vmbr0/eth0)
Dietmar Maurer [Wed, 14 May 2014 08:58:50 +0000 (10:58 +0200)]
fwtester: improve kernel simulation
Dietmar Maurer [Wed, 14 May 2014 05:21:19 +0000 (07:21 +0200)]
delete trailing whitespace cleanup
Alexandre Derumier [Wed, 14 May 2014 03:35:09 +0000 (05:35 +0200)]
allow multiple spaces in venet0 ip list
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Alexandre Derumier [Wed, 14 May 2014 03:26:55 +0000 (05:26 +0200)]
rename link+ to fwln+
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Alexandre Derumier [Tue, 13 May 2014 08:19:04 +0000 (10:19 +0200)]
bugfix : allow multiples venet0 ip in 1 container
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Alexandre Derumier [Mon, 12 May 2014 13:19:16 +0000 (15:19 +0200)]
insert PVEFW-IPS after vm rules generation v2
or it never match it
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Tue, 13 May 2014 12:18:08 +0000 (14:18 +0200)]
add Makefile targets for regression tests
Always run tests before assembling a Debian package.
Dietmar Maurer [Tue, 13 May 2014 12:09:49 +0000 (14:09 +0200)]
add regression test infrastructure
Dietmar Maurer [Tue, 13 May 2014 11:49:31 +0000 (13:49 +0200)]
allow to read config from test directory
I will use that for regression tests.
Dietmar Maurer [Mon, 12 May 2014 11:33:19 +0000 (13:33 +0200)]
use PVEFW-VENET-IN/OUT inside PVEFW-INPUT/OUTPUT chains
Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Mon, 12 May 2014 11:33:18 +0000 (13:33 +0200)]
move nosmurfs, tcpflags and conntrack established outside tap chains
These should be done fast,
conntrack established can be done in PVE-FORWARD now
smurf and tcpflags can be done in PVEFW-FWBR-IN and PVEFW-VENET-IN (don't
make sense to test them in OUT direction)
-A PVEFW-FORWARD ! -i fwbr+ -j ACCEPT
-A PVEFW-FORWARD -m conntrack --ctstate INVALID -j DROP
-A PVEFW-FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-FORWARD -m physdev --physdev-in link+ -j PVEFW-FWBR-IN
-A PVEFW-FWBR-IN -p tcp -j PVEFW-tcpflags
-A PVEFW-FWBR-IN -m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs
-A PVEFW-FWBR-IN -m physdev --physdev-out tap123i0 --physdev-is-bridged -j tap123i0-IN
-A PVEFW-FWBR-IN -m physdev --physdev-out veth0.0 --physdev-is-bridged -j veth0.0-IN
-A PVEFW-FORWARD -m physdev --physdev-is-bridged --physdev-out link+ -j PVEFW-FWBR-OUT
-A PVEFW-FWBR-OUT -m physdev --physdev-in tap123i0 -j tap123i0-OUT
-A PVEFW-FWBR-OUT -m physdev --physdev-in veth0.0 -j veth0.0-OUT
Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Mon, 12 May 2014 11:33:17 +0000 (13:33 +0200)]
remove dead code
Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Mon, 12 May 2014 11:33:16 +0000 (13:33 +0200)]
add PVEFW-VENET-IN && PVEFW-VENET-OUT chains
Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Mon, 12 May 2014 11:33:15 +0000 (13:33 +0200)]
remove bridge chains
-A PVEFW-FORWARD ! -i fwbr+ -j ACCEPT
-A PVEFW-FORWARD -m conntrack --ctstate INVALID -j DROP
-A PVEFW-FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-FORWARD -m physdev --physdev-is-bridged --physdev-in link+ -j PVEFW-FWBR-IN
-A PVEFW-FWBR-IN -m physdev --physdev-out tap123i0 --physdev-is-bridged -j tap123i0-IN
-A PVEFW-FWBR-IN -m physdev --physdev-out veth0.0 --physdev-is-bridged -j veth0.0-IN
-A PVEFW-FORWARD -m physdev --physdev-is-bridged --physdev-out link+ -j PVEFW-FWBR-OUT
-A PVEFW-FWBR-OUT -m physdev --physdev-in tap123i0 -j tap123i0-OUT
-A PVEFW-FWBR-OUT -m physdev --physdev-in veth0.0 -j veth0.0-OUT
Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Mon, 12 May 2014 11:33:14 +0000 (13:33 +0200)]
use hex digest to avoid url encoding problems
Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Mon, 12 May 2014 11:33:13 +0000 (13:33 +0200)]
avoid error about undefined array
Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Tue, 6 May 2014 09:18:25 +0000 (11:18 +0200)]
set RELEASE to 3.2
Dietmar Maurer [Tue, 6 May 2014 09:12:21 +0000 (11:12 +0200)]
remove allow_bridge_route setting
Not needed for new network model with additional bridge.
Dietmar Maurer [Thu, 24 Apr 2014 12:31:13 +0000 (14:31 +0200)]
firewall group API: change 'name' to 'group'
Alexandre Derumier [Tue, 22 Apr 2014 08:44:59 +0000 (10:44 +0200)]
add global ipset blacklist
this is a predefined ipset == blacklist,
which block ips at the begin of PVE-FORWARD.
(usefull in case of ddos attack)
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Tue, 22 Apr 2014 10:43:54 +0000 (12:43 +0200)]
generate_ipset: skip undefined ipsets
I introduced that bug when I changed die to warn.
Dietmar Maurer [Tue, 22 Apr 2014 10:37:03 +0000 (12:37 +0200)]
rename save_rules to save_ipset
Dietmar Maurer [Tue, 22 Apr 2014 10:33:05 +0000 (12:33 +0200)]
alias API: implement rename
Dietmar Maurer [Tue, 22 Apr 2014 09:45:52 +0000 (11:45 +0200)]
start API for aliases
Allow comments for aliases.
Dietmar Maurer [Tue, 22 Apr 2014 07:37:53 +0000 (09:37 +0200)]
correctly save aliases
Dietmar Maurer [Tue, 22 Apr 2014 07:08:05 +0000 (09:08 +0200)]
ruleset_generate_vm_rules: use 'warn' instead of 'die'
We want to be able to update our rules, even if somebody defined
a wrong rule for his VM.
Dietmar Maurer [Tue, 22 Apr 2014 07:02:04 +0000 (09:02 +0200)]
ruleset_generate_vm_rule: avoid multiple calls to generate_nfqueue()
Dietmar Maurer [Tue, 22 Apr 2014 06:59:02 +0000 (08:59 +0200)]
generate_nfqueue: code cleanup
Dietmar Maurer [Tue, 22 Apr 2014 06:53:48 +0000 (08:53 +0200)]
ruleset_generate_rule: update all or nothing
And use 'warn' instead of 'die' if alias does not exists.
Alexandre Derumier [Tue, 22 Apr 2014 06:17:00 +0000 (08:17 +0200)]
update update_nf_conntrack_max && nf_conntrack_tcp_timeout_established after modules load
/proc/sys/net/netfilter/nf_conntrack_tcp_timeout_established
and
/proc/sys/net/nf_conntrack_max
are empty by default, because conntrack module is not loaded, until we have apply iptables rules
So, we just need to update them after iptables commit (which load the conntrack modules)
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Tue, 22 Apr 2014 06:32:44 +0000 (08:32 +0200)]
code cleanup
Define $ip_alias_name to make it easier to read the code.
Alexandre Derumier [Tue, 22 Apr 2014 05:38:07 +0000 (07:38 +0200)]
iptables_get_chains : allow bridgevlan vmbrXvY
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Alexandre Derumier [Tue, 22 Apr 2014 03:57:15 +0000 (05:57 +0200)]
optimize : accept from physical interfaces on bridges
They are a lot of chance that a packet is coming/going from/to external network.
Currently, we need to check all tap chains before accept the packet from eth|bond interface.
This can have a big performance impact (mainly for drop|reject, as we don't have an established connection).
So It could be a problem in case of a ddos attack for example.
without optimize
----------------
-A vmbr1-FW -m physdev --physdev-is-in -j vmbr1-OUT
-A vmbr1-OUT -m physdev --physdev-in tapxxxi0 -j tapxxxi0-OUT
-A vmbr1-OUT -m physdev --physdev-in tapxxxi0 -j tapxxxi0-OUT
-A vmbr1-OUT -m physdev --physdev-in tapxxxi0 -j tapxxxi0-OUT
-A vmbr1-OUT -m physdev --physdev-in tapxxxi0 -j tapxxxi0-OUT
-A vmbr1-OUT -m physdev --physdev-in tapxxxi0 -j tapxxxi0-OUT
-A vmbr1-OUT -m physdev --physdev-in tapxxxi0 -j tapxxxi0-OUT
-A vmbr1-FW -m physdev --physdev-is-out -j vmbr1-IN
-A vmbr1-IN -m physdev --physdev-out tapxxxi0 --physdev-is-bridged -j tapxxxi0-IN
-A vmbr1-IN -m physdev --physdev-out tapxxxi0 --physdev-is-bridged -j tapxxxi0-IN
-A vmbr1-IN -m physdev --physdev-out tapxxxi0 --physdev-is-bridged -j tapxxxi0-IN
-A vmbr1-IN -m physdev --physdev-out tapxxxi0 --physdev-is-bridged -j tapxxxi0-IN
-A vmbr1-IN -m physdev --physdev-out tapxxxi0 --physdev-is-bridged -j tapxxxi0-IN
-A vmbr1-IN -m physdev --physdev-out tapxxxi0 --physdev-is-bridged -j tapxxxi0-IN
-A vmbr1-FW -m mark --mark 0x1 -j ACCEPT
-A vmbr1-FW -m physdev --physdev-is-out -j ACCEPT
with optimize
------------
-A vmbr1-FW -m physdev --physdev-is-in -j vmbr1-OUT
-A vmbr1-OUT -m physdev --physdev-in ethX --physdev-is-bridged -g PVEFW-SET-ACCEPT-MARK
-A vmbr1-OUT -m physdev --physdev-in tapxxxi0 -j tapxxxi0-OUT
-A vmbr1-OUT -m physdev --physdev-in tapxxxi0 -j tapxxxi0-OUT
-A vmbr1-OUT -m physdev --physdev-in tapxxxi0 -j tapxxxi0-OUT
-A vmbr1-OUT -m physdev --physdev-in tapxxxi0 -j tapxxxi0-OUT
-A vmbr1-OUT -m physdev --physdev-in tapxxxi0 -j tapxxxi0-OUT
-A vmbr1-OUT -m physdev --physdev-in tapxxxi0 -j tapxxxi0-OUT
-A vmbr1-FW -m physdev --physdev-is-out -j vmbr1-IN
-A vmbr1-IN -m physdev --physdev-out ethX --physdev-is-bridged -j ACCEPT
-A vmbr1-IN -m physdev --physdev-out tapxxxi0 --physdev-is-bridged -j tapxxxi0-IN
-A vmbr1-IN -m physdev --physdev-out tapxxxi0 --physdev-is-bridged -j tapxxxi0-IN
-A vmbr1-IN -m physdev --physdev-out tapxxxi0 --physdev-is-bridged -j tapxxxi0-IN
-A vmbr1-IN -m physdev --physdev-out tapxxxi0 --physdev-is-bridged -j tapxxxi0-IN
-A vmbr1-IN -m physdev --physdev-out tapxxxi0 --physdev-is-bridged -j tapxxxi0-IN
-A vmbr1-IN -m physdev --physdev-out tapxxxi0 --physdev-is-bridged -j tapxxxi0-IN
-A vmbr1-FW -m mark --mark 0x1 -j ACCEPT
-A vmbr1-FW -m physdev --physdev-is-out -j ACCEPT
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Alexandre Derumier [Sat, 19 Apr 2014 07:00:03 +0000 (09:00 +0200)]
add aliases feature
this allow to defined ip et network aliases,
which can be used in vm/group rules and also ipset
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Fri, 18 Apr 2014 08:50:15 +0000 (10:50 +0200)]
add README and example to debian package
Dietmar Maurer [Fri, 18 Apr 2014 08:43:30 +0000 (10:43 +0200)]
fix README
Dietmar Maurer [Fri, 18 Apr 2014 08:28:13 +0000 (10:28 +0200)]
only allow tcpflafgs and nosmurfs in host.fw
Dietmar Maurer [Fri, 18 Apr 2014 06:11:49 +0000 (08:11 +0200)]
enable cluster wide rules
Dietmar Maurer [Fri, 18 Apr 2014 05:44:32 +0000 (07:44 +0200)]
add remaining options to VM API
Dietmar Maurer [Fri, 18 Apr 2014 05:23:20 +0000 (07:23 +0200)]
add options and log API for VMs
Alexandre Derumier [Thu, 17 Apr 2014 04:42:50 +0000 (06:42 +0200)]
bugfix : ruleset_generate_cmdstr : use -d for destination
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Tue, 15 Apr 2014 10:28:05 +0000 (12:28 +0200)]
complete options API for host.fw
Dietmar Maurer [Tue, 15 Apr 2014 09:03:17 +0000 (11:03 +0200)]
add API for firewall log
Dietmar Maurer [Tue, 15 Apr 2014 08:38:40 +0000 (10:38 +0200)]
correctly initialize std chains
Else those chains grow if called from a daemon.
Dietmar Maurer [Tue, 15 Apr 2014 07:04:42 +0000 (09:04 +0200)]
do not set persistent state if firewall is disabled
Else we have to manually restart the service after enable is set.
Dietmar Maurer [Tue, 15 Apr 2014 06:15:53 +0000 (08:15 +0200)]
disable firewall by default
Dietmar Maurer [Tue, 15 Apr 2014 06:12:27 +0000 (08:12 +0200)]
add init script to start firewall
Alexandre Derumier [Tue, 15 Apr 2014 05:25:21 +0000 (07:25 +0200)]
ips : allow --queue-bypass only for kernel 3.10
This don't exist in 2.6.32 kernel
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Tue, 15 Apr 2014 05:29:50 +0000 (07:29 +0200)]
stop firewall inside update if firewall is disabled in cluster.fw
And some code cleanups.
Dietmar Maurer [Mon, 14 Apr 2014 10:51:16 +0000 (12:51 +0200)]
implement API for cluster.fw policy_in and policy_out options
Dietmar Maurer [Mon, 14 Apr 2014 10:21:38 +0000 (12:21 +0200)]
move host policy setting to cluster.fw
Because we also have cluster wide rules
Dietmar Maurer [Mon, 14 Apr 2014 10:06:45 +0000 (12:06 +0200)]
remove option dhcp for host.fw
Alexandre Derumier [Mon, 14 Apr 2014 07:59:47 +0000 (09:59 +0200)]
add tunnable nf_conntrack_tcp_timeout_established value
default nf_conntrack_tcp_timeout_established value is 5 days.
This is really huge, in case of a ddos attack for example
from:
https://dev.openwrt.org/ticket/12976
minimum value should be
"7875 seconds (= tcp_keepalive_time + tcp_keepalive_probes * tcp_keepalive_intvl = 7200 + 9 * 75 by default) to give the endpoints sufficient time to send keep-alive probes"
Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
Dietmar Maurer [Fri, 11 Apr 2014 10:52:48 +0000 (12:52 +0200)]
copy_xxx_with_digest: do not copy undefined values
Dietmar Maurer [Fri, 11 Apr 2014 09:32:32 +0000 (11:32 +0200)]
improve concurrent update handling
compute digest per section.
Dietmar Maurer [Thu, 10 Apr 2014 10:28:50 +0000 (12:28 +0200)]
correctly encode section comments as utf8
Dietmar Maurer [Thu, 10 Apr 2014 10:08:48 +0000 (12:08 +0200)]
support comments on ipset sections
Also implement concurrenty change prevention for ipset API.
Dietmar Maurer [Thu, 10 Apr 2014 08:44:56 +0000 (10:44 +0200)]
rules API: protect against concurrent updates
Dietmar Maurer [Thu, 10 Apr 2014 08:38:48 +0000 (10:38 +0200)]
security group API: protect against concurrent updates
Dietmar Maurer [Thu, 10 Apr 2014 07:01:28 +0000 (09:01 +0200)]
define standard option pve-config-digest
Dietmar Maurer [Wed, 9 Apr 2014 10:53:12 +0000 (12:53 +0200)]
support comments on group sections
Dietmar Maurer [Wed, 9 Apr 2014 07:48:42 +0000 (09:48 +0200)]
correctly save security group rules
Dietmar Maurer [Wed, 9 Apr 2014 06:53:58 +0000 (08:53 +0200)]
complete security group API
Dietmar Maurer [Wed, 9 Apr 2014 06:05:51 +0000 (08:05 +0200)]
define standard option for security group names
Dietmar Maurer [Wed, 9 Apr 2014 05:34:06 +0000 (07:34 +0200)]
correctly verify ipset name
Dietmar Maurer [Wed, 9 Apr 2014 05:15:14 +0000 (07:15 +0200)]
IPSet: implement rename API
Dietmar Maurer [Wed, 9 Apr 2014 05:02:01 +0000 (07:02 +0200)]
add newline to error message
Dietmar Maurer [Tue, 8 Apr 2014 10:50:47 +0000 (12:50 +0200)]
ipset: implement create/delete API
Dietmar Maurer [Tue, 8 Apr 2014 09:18:03 +0000 (11:18 +0200)]
ipset API: add get/update methods
Dietmar Maurer [Tue, 8 Apr 2014 05:21:58 +0000 (07:21 +0200)]
fix ipset ref test in parse_address_list
Dietmar Maurer [Mon, 7 Apr 2014 11:27:42 +0000 (13:27 +0200)]
improve ipset updates
Remove duplicates, remove stale _swap chains, better cidr parser
Dietmar Maurer [Mon, 7 Apr 2014 10:44:22 +0000 (12:44 +0200)]
ipset: implement delete API, improve parameter verification
Dietmar Maurer [Mon, 7 Apr 2014 10:31:45 +0000 (12:31 +0200)]
start API for IPSet
Dietmar Maurer [Mon, 7 Apr 2014 09:02:14 +0000 (11:02 +0200)]
ipset: only save ip/network once
We do not allow duplicate entries.
Dietmar Maurer [Mon, 7 Apr 2014 08:41:35 +0000 (10:41 +0200)]
correctly save ipset data
Dietmar Maurer [Mon, 7 Apr 2014 06:32:29 +0000 (08:32 +0200)]
allow icmp port names
Dietmar Maurer [Mon, 7 Apr 2014 05:12:57 +0000 (07:12 +0200)]
verify macro parameters when updating a rule using API
Dietmar Maurer [Fri, 4 Apr 2014 11:22:12 +0000 (13:22 +0200)]
fix port parser
And correctly verify rules on updates on API.
Dietmar Maurer [Fri, 4 Apr 2014 07:33:26 +0000 (09:33 +0200)]
add macro descriptions (and API to read them)
Dietmar Maurer [Thu, 3 Apr 2014 11:28:50 +0000 (13:28 +0200)]
implement delete parameter for rule update API
Dietmar Maurer [Thu, 3 Apr 2014 09:48:48 +0000 (11:48 +0200)]
rule type and action are required parameters
Dietmar Maurer [Thu, 3 Apr 2014 07:33:20 +0000 (09:33 +0200)]
simplify check for iprange
We already parsed the address, so we can do a simpler check.
Dietmar Maurer [Thu, 3 Apr 2014 07:29:56 +0000 (09:29 +0200)]
parse_address_list: add check for ipset references.
Dietmar Maurer [Thu, 3 Apr 2014 07:25:28 +0000 (09:25 +0200)]
parse_address_list: only allow one ip range
The previous check did not work if the range is the first entry in the list,
for example:
IN ACCEPT net0 10.0.0.1-10.0.0.10,10.0.0.12