Node.js net, dns va tls: TCP soket, DNS so'rovi va TLS sertifikati

Qisqacha: HTTP — TCP ustidagi kelishuv. node:net TCP darajasida ishlaydi. net.createServer ulanishlarni qabul qiladi. Har ulanish — ikki tomonlama soket. node:dns da ikki yo'l bor: dns.lookup operatsion tizimdan so'raydi (hosts fayli, kesh), dns.resolve* esa to'g'ridan DNS serverga boradi. node:tls soketni shifrlaydi va sertifikat zanjirini tekshiradi. Biz o'lchadik: localhost avval ::1 (IPv6) ga aylanadi — server faqat 127.0.0.1 da bo'lsa, autoSelectFamily o'chiq ulanish ECONNREFUSED oladi.

Bu darsda

• net.createServer va net.connect bilan kichik TCP server va mijoz yozasiz.
• TCP'da xabar chegarasi yo'qligini va uni qator bilan qanday hal qilishni bilasiz.
• dns.lookup va dns.resolve farqini va qaysi biri qachon ishlatilishini tushuntirasiz.
• IPv4/IPv6 va autoSelectFamily (Happy Eyeballs) nima uchun kerakligini ko'rasiz.
• tls.connect bilan sertifikat zanjirini o'qiysiz va servername xatosini tushuntirasiz.

Oldin bilishingiz kerak: Protokol qatlamlari: TCP va UDP, Domen va DNS, HTTPS va TLS, libuv thread pool, readline va terminal.

1. Nega bu kerak?

valyuta CBU'ga fetch bilan murojaat qiladi va hammasi bitta qator: await fetch(url). Lekin shu qator ichida to'rt bosqich yashiringan:

1. cbu.uz nomini IP manzilga aylantirish — DNS.
2. O'sha IP'ning 443-portiga ulanish — TCP.
3. Ulanishni shifrlash va server haqiqatan cbu.uz ekanini tekshirish — TLS.
4. Shundan keyingina HTTP so'rov va javob.

Har bosqich o'z xatosi bilan yiqiladi: ENOTFOUND (nom topilmadi), ECONNREFUSED (port yopiq), ETIMEDOUT (javob yo'q), ERR_TLS_CERT_ALTNAME_INVALID (sertifikat boshqa domenga). Bu nomlarni ko'rib, muammo qaysi qatlamda ekanini bilsangiz — tuzatish ikki baravar tezlashadi. "Proxy ishlamayapti", "localhost'ga ulanmayapti", "sertifikat xatosi" — backend dasturchining kundalik muammolari.

O'xshatish: pochta orqali xat yuborish. DNS — manzillar kitobi (ism → uy manzili). TCP — pochtachi: xatlarni tartib bilan, yo'qotmasdan yetkazadi. TLS — muhrlangan konvert va pasport tekshiruvi: o'qib bo'lmaydi, oluvchi haqiqatan o'sha odam.

flowchart LR
  A["fetch(cbu.uz)"] --> D["DNS<br/>nom → IP"]
  D --> T["TCP<br/>185.203.237.70:443"]
  T --> S["TLS<br/>shifr, sertifikat"]
  S --> H["HTTP<br/>GET /json/"]

Diagrammada har quti — Node'dagi alohida modul: dns, net, tls, keyin http. HTTP serverni 25-qismda o'zimiz yozamiz; bu dars — undan pastdagi qavatlar.

2. net: TCP server va soket

2.1 Birinchi server

Soket (socket) — ikki dastur orasidagi bitta TCP ulanishning bir uchi. U ham o'qiladigan, ham yoziladigan oqim: undan ma'lumot kelib turadi va unga yozasiz. Stream nima darsida bunday oqimni Duplex deb ataymiz.

Valyuta kursini beradigan kichik server: mijoz qator yuboradi (usd), server javob qaytaradi (USD 11903.15):

import net from "node:net";
import { createInterface } from "node:readline";

const RATES = { USD: 11903.15, EUR: 13372.4 };

const server = net.createServer((socket) => {
  const rl = createInterface({ input: socket });
  rl.on("line", (line) => {
    const code = line.trim().toUpperCase();
    const known = code in RATES;
    const answer = known ? `${code} ${RATES[code]}` : `XATO ${code}`;
    socket.write(answer + "\n");
  });
});
await new Promise((r) => server.listen(0, "127.0.0.1", r));
const { port } = server.address();

const client = net.connect(port, "127.0.0.1");
client.write("usd\neur\n");
client.end("gbp\n");
let reply = "";
for await (const chunk of client) reply += chunk;
console.log(reply.trim());
server.close();

Konsolda:

USD 11903.15
EUR 13372.4
XATO GBP

Qadam-baqadam:

• net.createServer(callback) — har yangi ulanishda callback chaqiriladi va unga soket beriladi.
• listen(0, "127.0.0.1") — 0-port "OS bo'sh portni o'zi tanlasin" degani. Tanlangan port server.address().port da. Testlarda shunday qilinadi — port band bo'lib qolmaydi. valyuta ning soxta CBU serveri ham shunday.
• "127.0.0.1" — faqat shu kompyuterdan ulanish mumkin. "0.0.0.0" (yoki host berilmasa) — tarmoqdagi boshqa kompyuterlardan ham.
• net.connect(port, host) — mijoz soketi. write — yuborish, end(...) — oxirgi xabar va "men boshqa yozmayman".
• for await (const chunk of client) — server javobini server ulanishni yopguncha o'qiydi.

2.2 TCP'da xabar chegarasi yo'q

Nega serverda readline ishlatdik? Chunki TCP — bayt oqimi, xabarlar ketma-ketligi emas. Mijoz uch marta write qildi, lekin server ularni bitta bo'lakda olishi mumkin — yoki bitta write ni ikki bo'lakda. TCP faqat baytlar tartibini va yo'qolmasligini kafolatlaydi.

Shuning uchun har protokol o'z chegaralash (framing) qoidasini kiritadi:

Bizning serverda readline bo'laklarni yig'ib, faqat to'liq qatorlarni beradi — readline darsidagi "lag'mon" misolining tarmoqdagi ko'rinishi.

2.3 Soket hodisalari va yopilish

socket.end() — muloyim yopish: "yozish tugadi". socket.destroy() — keskin uzish. socket.setTimeout(ms) — shuncha vaqt jim tursa "timeout" hodisasi (soketni o'zi yopmaydi — yopishni siz qilasiz).

Diqqat: Soketda "error" tinglovchisi bo'lmasa, xato butun jarayonni yiqitadi. Biz sinovda mijozni keskin uzganimizda (destroy), server tomondagi soket read ECONNRESET ("ulanish qarshi tomondan uzildi") oldi va server Unhandled 'error' event bilan tushdi. Bitta mijozning uzilishi butun serverni o'ldirmasligi uchun har soketga socket.on("error", …) qo'ying. Nega "error" hodisasi bunchalik maxsus — EventEmitter asoslari darsida.

Tekshirib ko'ring: Mijoz write("100 u") va write("sd\n") qildi. Bizning server nechta javob qaytaradi?

3. dns: nomdan IP'gacha

3.1 Ikki xil yo'l

node:dns da nomni IP'ga aylantirishning ikki butunlay boshqa yo'li bor:

Kanon cbu.uz uchun ikkalasini o'lchadi (natijalar/tajriba/t26-net.txt): lookup — 1 ms (OS keshidan), resolve4 — 6 ms (DNS serverga borib keldi), natija bir xil: 185.203.237.70. Biz shu mashinada keyinroq qayta ishga tushirganimizda (Node 24.21.0, Windows 11) lookup 33 ms bo'ldi — OS keshi bo'shagan edi. Vaqt keshga bog'liq.

3.2 Farq ko'rinadigan joy

Biz bir nechta so'rovni ishga tushirdik (Node 24.21.0, Windows 11; tarmoqqa bog'liq):

import dns from "node:dns/promises";

console.log(await dns.lookup("localhost", { all: true }));
try {
  await dns.resolve4("localhost");
} catch (e) {
  console.log("resolve4 localhost:", e.code);
}
console.log(await dns.resolveMx("cbu.uz"));
try {
  await dns.lookup("bunday-domen-yoq.example");
} catch (e) {
  console.log(e.code, e.message);
}

Biz ishga tushirgan chiqish:

[ { address: '::1', family: 6 }, { address: '127.0.0.1', family: 4 } ]
resolve4 localhost: ESERVFAIL
[
  { exchange: 'smtp.cbu.uz', priority: 20, type: 'MX' },
  { exchange: 'mail.cbu.uz', priority: 10, type: 'MX' }
]
ENOTFOUND getaddrinfo ENOTFOUND bunday-domen-yoq.example

Uchta saboq:

• localhost ni lookup topdi (OS biladi), resolve4 esa topa olmadi — ESERVFAIL. localhost — internet DNS'ida emas, kompyuterning hosts faylida.
• resolveMx — pochta serverlari (MX yozuvlari). Bunday maxsus yozuvlarni faqat resolve* beradi. Email domenini tekshirish shunday qilinadi.
• ENOTFOUND xabarida getaddrinfo so'zi — bu lookup (OS funksiyasi) ekanining belgisi.

3.3 Nega bu thread pool bilan bog'liq

libuv thread pool darsidan eslang: pool'da sukut bo'yicha 4 ta thread bor va fs ham, crypto ham, dns.lookup ham shu to'rttasini bo'lishadi. Sekin DNS server bo'lsa, lookup lar pool'ni egallaydi va fayl o'qish ham navbatda turadi. Ko'p tashqi so'rov yuboradigan serverlarda bu haqiqiy muammo. Yechimlar: UV_THREADPOOL_SIZE ni oshirish yoki DNS natijasini keshlash.

Tekshirib ko'ring: hosts fayliga 127.0.0.1 kurs.test qo'shildi. dns.lookup("kurs.test") va dns.resolve4("kurs.test") nima qaytaradi?

4. IPv4, IPv6 va autoSelectFamily

localhost ikki manzilga aylandi: avval ::1 (IPv6), keyin 127.0.0.1 (IPv4). Node 17 dan beri lookup natijalarni OS bergan tartibda qaytaradi (dns.getDefaultResultOrder() → "verbatim"). Endi server faqat IPv4 da tinglasa nima bo'ladi?

import net from "node:net";

const server = net.createServer((s) => s.end("salom\n"));
await new Promise((r) => server.listen(0, "127.0.0.1", r));
const { port } = server.address();

for (const autoSelectFamily of [false, true]) {
  await new Promise((done) => {
    const opts = { port, host: "localhost", autoSelectFamily };
    const c = net.connect(opts);
    c.on("connect", () =>
      console.log(autoSelectFamily, "→", c.remoteAddress));
    c.on("error", (e) => {
      console.log(autoSelectFamily, "→", e.code, e.address);
      done();
    });
    c.on("close", done);
  });
}
server.close();

Biz ishga tushirgan chiqish (Windows 11):

false → ECONNREFUSED ::1
true → 127.0.0.1

autoSelectFamily: false bo'lsa, Node faqat birinchi manzilni (::1) sinaydi. U yerda hech kim tinglamaydi — rad. true — Node Happy Eyeballs algoritmini ishlatadi: manzillarni navbat bilan, har biriga qisqa vaqt (sukut 250 ms) berib sinaydi va birinchi ulanganini oladi. Node 20 dan beri true — sukut (net.getDefaultAutoSelectFamily() → true).

Bu muammo 2022–2023 yillarda juda mashhur edi: Node 17 tartibni o'zgartirgach, "localhost:3000 ga ulanmayapti, 127.0.0.1:3000 ga ulanadi" degan savollar ko'paydi. Hozir sukut bo'yicha hal qilingan, lekin eski konfiguratsiyalarda yoki autoSelectFamily o'chirilgan kutubxonalarda hali ham uchraydi. Linux'da localhost tartibi /etc/hosts ga bog'liq (biz o'lchamadik).

5. tls: shifrlangan soket

5.1 Ulanish va sertifikat zanjiri

HTTPS va TLS darsida nazariyani ko'rgansiz: server sertifikat ko'rsatadi, sertifikatni ishonchli sertifikat markazi (CA) imzolagan, mijoz zanjirni ildizgacha tekshiradi. node:tls bu jarayonni qo'lda ko'rish imkonini beradi:

import tls from "node:tls";

const socket = tls.connect(
  { host: "cbu.uz", port: 443, servername: "cbu.uz" },
  () => {
    console.log(socket.getProtocol(), socket.authorized);
    let cert = socket.getPeerCertificate(true);
    const seen = new Set();
    while (cert && !seen.has(cert.fingerprint256)) {
      seen.add(cert.fingerprint256);
      console.log(`${cert.subject.CN} ← ${cert.issuer.CN}`);
      cert = cert.issuerCertificate;
    }
    socket.end();
  },
);

Biz ishga tushirgan chiqish (2026-10-23):

TLSv1.3 true
cbu.uz ← RapidSSL TLS RSA CA G1
RapidSSL TLS RSA CA G1 ← DigiCert Global Root G2
DigiCert Global Root G2 ← DigiCert Global Root G2

O'qing pastdan yuqoriga:

• DigiCert Global Root G2 — ildiz sertifikat. O'zini o'zi imzolagan (← dan keyin o'zi). U Node ichiga o'rnatilgan ishonchli ildizlar ro'yxatida bor.
• RapidSSL TLS RSA CA G1 — oraliq CA: ildiz uni imzolagan.
• cbu.uz — saytning o'z sertifikati: oraliq CA imzolagan, 2026-yil 29-noyabrgacha amal qiladi.

getPeerCertificate(true) — zanjir bilan. seen to'plami kerak: ildizning issuerCertificate i o'ziga ishora qiladi, usiz sikl cheksiz bo'lardi. socket.authorized === true — Node zanjirni tekshirdi va ishondi. Kanon tajribasida ham xuddi shu: TLSv1.3, authorized: true, muddat 2026-11-29. Kanon issuer'ning tashkilot nomini yozgan (DigiCert Inc) — RapidSSL DigiCert'ning brendi, zid emas.

5.2 servername va xato

servername — SNI (Server Name Indication): mijoz "men qaysi saytga kelyapman" deb aytadi. Bitta IP'da yuzlab sayt bo'lishi mumkin, server shunga qarab sertifikat tanlaydi. Node esa sertifikatdagi nom servername ga mos kelishini tekshiradi. Kanon ataylab boshqa nom berdi:

const bad = tls.connect({
  host: "cbu.uz",
  port: 443,
  servername: "boshqa.example",
});
bad.on("error", (e) => console.log("servername mos emas:", e.code));

Kanon tajribasi (t26-net.txt):

servername mos emas: ERR_TLS_CERT_ALTNAME_INVALID

"Sertifikatdagi muqobil nomlar (altnames) yaroqsiz" — sertifikat cbu.uz uchun, biz boshqa.example ni kutgan edik. Bu himoya: kimdir sizni boshqa serverga yo'naltirib, o'z (haqiqiy, lekin boshqa domenga berilgan) sertifikatini ko'rsatsa, ulanish shu yerda to'xtaydi.

6. Hujumchi nigohi: rejectUnauthorized: false

Ichki serverda o'z-o'zidan imzolangan sertifikat bo'lsa, fetch yoki tls.connect self-signed certificate ("o'zi imzolagan sertifikat") xatosini beradi. Internetdagi eng ko'p tavsiya etiladigan "yechim":

// ❌ butun tekshiruvni o'chiradi
tls.connect({ host, port, rejectUnauthorized: false });
// ❌ yanada yomoni — butun jarayon uchun
process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

Hujumchi uchun bu sovg'a. Kafedagi ochiq Wi-Fi'da u o'zini router qilib ko'rsatadi va sizning ulanishingizni o'z serveriga yo'naltiradi (MITM — man-in-the-middle, "o'rtadagi odam"). Tekshiruv o'chiq bo'lsa, Node hujumchining sertifikatini ham qabul qiladi: shifr bor, lekin siz hujumchi bilan gaplashyapsiz. API kalitlari, parollar — hammasi unga.

To'g'ri yo'llar:

NODE_TLS_REJECT_UNAUTHORIZED=0 ni o'rnatsangiz, Node o'zi ham ogohlantiradi — bu ogohlantirishni hech qachon e'tiborsiz qoldirmang.

7. CLI qadami: holat yo'q — fetch hammasini qiladi

valyuta net, dns yoki tls ni to'g'ridan ishlatmaydi: fetch (Node ichidagi undici) DNS, TCP va TLS'ni o'zi bajaradi va to'g'ri sukut sozlamalar bilan (autoSelectFamily, sertifikat tekshiruvi). Qo'lda soket yozish CLI uchun faqat xato manbai bo'lardi. Shuning uchun bu darsning o'rni — kanon tajribasi (t26-net.txt) va ikkita amaliy saboq.

Birinchi saboq — xato nomini o'qish. valyuta ning xatolarini endi qatlam bo'yicha ajrata olasiz: ENOTFOUND — DNS, ECONNREFUSED — TCP (port yopiq), ERR_TLS_CERT_… — TLS, TimeoutError — timers darsidagi timeout.

Ikkinchi saboq — 127.0.0.1:9 siri. Timers darsida valyuta testlari va jonli sinov "ishlamaydigan server" sifatida http://127.0.0.1:9/ ni ishlatdi. Biz net va fetch ni yonma-yon sinadik (Node 24.21.0, Windows 11). Natija tarmoqqa emas, faqat shu kompyuterga bog'liq, shuning uchun har safar bir xil chiqadi:

import net from "node:net";

const sock = net.connect(9, "127.0.0.1");
sock.on("error", (e) => console.log("net 9:", e.code));
await new Promise((r) => sock.on("close", r));

for (const port of [9, 59999]) {
  try {
    await fetch(`http://127.0.0.1:${port}/`);
  } catch (e) {
    console.log(`fetch ${port}:`, e.cause?.code ?? e.cause?.message);
  }
}

Konsolda:

net 9: ECONNREFUSED
fetch 9: bad port
fetch 59999: ECONNREFUSED

net 9-portga haqiqatan ulanishga urindi va rad oldi. fetch esa 9-portga umuman urinmadi. Fetch standartida xavfli portlar ro'yxati bor (9, 25 — SMTP, 6000 va boshqalar) va brauzer ham, Node ham ularga HTTP so'rov yubormaydi. Haqiqiy "port yopiq" — 59999 da. Ikkala holat ham valyuta uchun "tarmoq xatosi", lekin sababi boshqa. Bu farqni error.cause darsida kanon ham topadi. Bu darsda commit yo'q.

8. Ko'p uchraydigan xatolar

9. Mashqlar

Mashqlar kurs/mashqlar/24/26-net-dns-tls/ da.

1-mashq (oson): qaysi qatlam?

• getaddrinfo ENOTFOUND kurs.example —
• connect ECONNREFUSED 127.0.0.1:5432 —
• ERR_TLS_CERT_ALTNAME_INVALID —
• hosts faylini o'qiydigan funksiya — dns.
• OS bo'sh port tanlasin — server.listen()

2-mashq (o'rta): uzunlik prefiksli xabarlar

Qator o'rniga boshqa chegaralash: har xabar oldidan uning uzunligi va : keladi — 5:salom. decode(chunks) funksiyasini yozing: bo'laklar massivini oladi (xabar bo'lak chegarasida bo'linishi mumkin) va to'liq xabarlar ro'yxatini qaytaradi. Sinang: ["5:sal", "om3:osh1", "0:ko'k choy!"].

function decode(chunks) {
  let buffer = "";
  const messages = [];
  for (const chunk of chunks) {
    buffer += chunk;
    while (true) {
      const colon = buffer.indexOf(":");
      if (colon === -1) break;
      const length = Number(buffer.slice(0, colon));
      const end = colon + 1 + length;
      if (buffer.length < end) break; // xabar hali to'liq kelmadi
      messages.push(buffer.slice(colon + 1, end));
      buffer = buffer.slice(end);
    }
  }
  return messages;
}

console.log(decode(["5:sal", "om3:osh1", "0:ko'k choy!"]));

[ 'salom', 'osh', "ko'k choy!" ]

3-mashq (qiyin): kurs serveri — jami summa

«Birinchi server» misolini kengaytiring: mijoz 100 usd ko'rinishidagi qator yuborsa, server 100 USD = 1190315 UZS (butun songa yaxlitlangan) qaytarsin; noto'g'ri qator — XATO. Har soketga "error" tinglovchisi qo'ying. Mijoz 100 usd, 2 eur, salom yuboradi.

import net from "node:net";
import { createInterface } from "node:readline";

const RATES = { USD: 11903.15, EUR: 13372.4 };

function convert(line) {
  const [amountText, codeText = ""] = line.trim().split(/\s+/);
  const amount = Number(amountText);
  const code = codeText.toUpperCase();
  if (!Number.isFinite(amount) || !(code in RATES)) return "XATO";
  const sum = Math.round(amount * RATES[code]);
  return `${amount} ${code} = ${sum} UZS`;
}

const server = net.createServer((socket) => {
  socket.on("error", () => {}); // bitta mijoz — butun server emas
  const rl = createInterface({ input: socket });
  rl.on("line", (line) => socket.write(convert(line) + "\n"));
});
await new Promise((r) => server.listen(0, "127.0.0.1", r));

const client = net.connect(server.address().port, "127.0.0.1");
client.end("100 usd\n2 eur\nsalom\n");
let reply = "";
for await (const chunk of client) reply += chunk;
console.log(reply.trim());
server.close();

100 USD = 1190315 UZS
2 EUR = 26745 UZS
XATO

4-mashq: CLI qadami — xatolarni qatlam bo'yicha ajrating

O'z valyuta ingizda uch xil noto'g'ri VALYUTA_API bilan ishga tushiring va har chiqishdagi "Ogohlantirish" qatorini yozib oling: http://yoq.invalid/, http://127.0.0.1:59999/, http://127.0.0.1:9/. Hozircha uchalasi ham bir xil "tarmoq xatosi" deydi — qaysi qatlamda yiqilganini o'zingiz yozing. Kod o'zgarmaydi.

10. Real ishda

• Ma'lumotlar bazasi ulanishi — PostgreSQL drayveri net.connect bilan 5432-portga ulanadi, TLS ixtiyoriy. "Bazaga ulanmayapti" xatolari aynan shu darsdagi kodlar.
• Redis, SMTP, MQTT — qatorli yoki uzunlik prefiksli TCP protokollari. Ularning Node drayverlari net.Socket ustida yozilgan.
• Konteyner va localhost — Docker ichidagi server 127.0.0.1 da tinglasa, tashqaridan ko'rinmaydi; 0.0.0.0 kerak. Bu deploy qismlarida qayta chiqadi.
• Sertifikat muddati — monitoring skriptlari tls.connect + getPeerCertificate().valid_to bilan "sertifikat 14 kunda tugaydi" ogohlantirishini yuboradi.
• Intervyuda: "brauzerga URL yozilgandan keyin nima bo'ladi?" — DNS → TCP → TLS → HTTP; "lookup va resolve farqi?".

Xulosa

• net.createServer / net.connect — TCP soketlar; port 0 — OS tanlaydi; har soketga "error" tinglovchisi.
• TCP — bayt oqimi, xabar chegarasi yo'q: qator (readline), uzunlik prefiksi yoki sarlavha bilan chegaralang.
• dns.lookup — OS (hosts, kesh, thread pool); dns.resolve* — to'g'ridan DNS server va maxsus yozuvlar (MX).
• localhost → avval ::1; autoSelectFamily (sukut true) manzillarni navbat bilan sinaydi.
• tls.connect zanjirni ildizgacha tekshiradi; rejectUnauthorized: false — MITM'ga ochiq eshik, o'rniga NODE_EXTRA_CA_CERTS.

Keyingi dars: EventEmitter asoslari — soket, readline, stream — hammasi hodisa chiqaradi. on, emit va "error" ning maxsusligi.

Manbalar

• Node.js hujjati — Net (createServer, connect, autoSelectFamily, getDefaultAutoSelectFamily): https://nodejs.org/docs/latest-v24.x/api/net.html
• Node.js hujjati — DNS ("Implementation considerations": lookup vs resolve, thread pool; setDefaultResultOrder): https://nodejs.org/docs/latest-v24.x/api/dns.html
• Node.js hujjati — TLS (connect, getPeerCertificate, servername, rejectUnauthorized, NODE_EXTRA_CA_CERTS): https://nodejs.org/docs/latest-v24.x/api/tls.html
• Fetch Standard — "bad port" ro'yxati: https://fetch.spec.whatwg.org/#port-blocking
• RFC 8305 — Happy Eyeballs Version 2: https://www.rfc-editor.org/rfc/rfc8305
• Kanon: natijalar/tajriba/t26-net.txt (Node 24.21.0, Windows 11, 2026-10-23). IPv6/autoSelectFamily, DNS so'rovlari, TLS zanjiri, 9-port va ECONNRESET — biz ishga tushirdik (Node 24.21.0, Windows 11, 2026-10-23).