2 * Copyright information at end of file.
5 #include <security/_pam_macros.h>
6 #include <security/pam_modules.h>
10 #include <sys/types.h>
24 #elif defined(HAVE_CRYPT_H)
30 #include "passverify.h"
33 #include <selinux/selinux.h>
34 #define SELINUX_ENABLED is_selinux_enabled()>0
36 #define SELINUX_ENABLED 0
40 #define pam_modutil_getpwnam(h,n) getpwnam(n)
41 #define pam_modutil_getspnam(h,n) getspnam(n)
42 #define pam_syslog(h,a,b,c) helper_log_err(a,b,c)
44 #include <security/pam_modutil.h>
45 #include <security/pam_ext.h>
48 #if defined(USE_LCKPWDF) && !defined(HAVE_LCKPWDF)
49 # include "./lckpwdf.-c"
53 strip_hpux_aging(char *hash)
55 static const char valid[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
56 "abcdefghijklmnopqrstuvwxyz"
58 if ((*hash != '$') && (strlen(hash) > 13)) {
59 for (hash += 13; *hash != '\0'; hash++) {
60 if (strchr(valid, *hash) == NULL) {
69 verify_pwd_hash(const char *p, char *hash, unsigned int nullok)
76 strip_hpux_aging(hash);
77 hash_len = strlen(hash);
79 /* the stored password is NULL */
80 if (nullok) { /* this means we've succeeded */
81 D(("user has empty password - access granted"));
84 D(("user has empty password - access denied"));
85 retval = PAM_AUTH_ERR;
87 } else if (!p || *hash == '*' || *hash == '!') {
88 retval = PAM_AUTH_ERR;
90 if (!strncmp(hash, "$1$", 3)) {
91 pp = Goodcrypt_md5(p, hash);
92 if (pp && strcmp(pp, hash) != 0) {
94 pp = Brokencrypt_md5(p, hash);
96 } else if (*hash != '$' && hash_len >= 13) {
97 pp = bigcrypt(p, hash);
98 if (pp && hash_len == 13 && strlen(pp) > hash_len) {
99 _pam_overwrite(pp + hash_len);
103 * Ok, we don't know the crypt algorithm, but maybe
104 * libcrypt knows about it? We should try it.
107 struct crypt_data *cdata;
108 cdata = malloc(sizeof(*cdata));
110 cdata->initialized = 0;
111 pp = x_strdup(crypt_r(p, hash, cdata));
112 memset(cdata, '\0', sizeof(*cdata));
116 pp = x_strdup(crypt(p, hash));
119 p = NULL; /* no longer needed here */
121 /* the moment of truth -- do we agree with the password? */
122 D(("comparing state of pp[%s] and hash[%s]", pp, hash));
124 if (pp && strcmp(pp, hash) == 0) {
125 retval = PAM_SUCCESS;
127 retval = PAM_AUTH_ERR;
133 D(("done [%d].", retval));
139 is_pwd_shadowed(const struct passwd *pwd)
142 if (strcmp(pwd->pw_passwd, "x") == 0) {
145 if ((pwd->pw_passwd[0] == '#') &&
146 (pwd->pw_passwd[1] == '#') &&
147 (strcmp(pwd->pw_name, pwd->pw_passwd + 2) == 0)) {
154 PAMH_ARG_DECL(int get_account_info,
155 const char *name, struct passwd **pwd, struct spwd **spwdent)
157 /* UNIX passwords area */
158 *pwd = pam_modutil_getpwnam(pamh, name); /* Get password file entry... */
162 if (strcmp((*pwd)->pw_passwd, "*NP*") == 0)
164 #ifdef HELPER_COMPILE
165 uid_t save_euid, save_uid;
167 save_euid = geteuid();
169 if (save_uid == (*pwd)->pw_uid)
170 setreuid(save_euid, save_uid);
173 if (setreuid(-1, (*pwd)->pw_uid) == -1) {
176 if(setreuid(-1, (*pwd)->pw_uid) == -1)
177 return PAM_CRED_INSUFFICIENT;
181 *spwdent = pam_modutil_getspnam(pamh, name);
182 if (save_uid == (*pwd)->pw_uid)
183 setreuid(save_uid, save_euid);
186 setreuid(save_uid, -1);
187 setreuid(-1, save_euid);
190 if (*spwdent == NULL || (*spwdent)->sp_pwdp == NULL)
191 return PAM_AUTHINFO_UNAVAIL;
193 /* we must run helper for NIS+ passwords */
194 return PAM_UNIX_RUN_HELPER;
196 } else if (is_pwd_shadowed(*pwd)) {
198 * ...and shadow password file entry for this user,
199 * if shadowing is enabled
201 #ifndef HELPER_COMPILE
202 if (geteuid() || SELINUX_ENABLED)
203 return PAM_UNIX_RUN_HELPER;
205 *spwdent = pam_modutil_getspnam(pamh, name);
206 if (*spwdent == NULL || (*spwdent)->sp_pwdp == NULL)
207 return PAM_AUTHINFO_UNAVAIL;
210 return PAM_USER_UNKNOWN;
215 PAMH_ARG_DECL(int get_pwd_hash,
216 const char *name, struct passwd **pwd, char **hash)
219 struct spwd *spwdent = NULL;
221 retval = get_account_info(PAMH_ARG(name, pwd, &spwdent));
222 if (retval != PAM_SUCCESS) {
227 *hash = x_strdup(spwdent->sp_pwdp);
229 *hash = x_strdup((*pwd)->pw_passwd);
236 PAMH_ARG_DECL(int check_shadow_expiry,
237 struct spwd *spent, int *daysleft)
241 curdays = (long int)(time(NULL) / (60 * 60 * 24));
242 D(("today is %d, last change %d", curdays, spent->sp_lstchg));
243 if ((curdays > spent->sp_expire) && (spent->sp_expire != -1)) {
244 D(("account expired"));
245 return PAM_ACCT_EXPIRED;
247 if (spent->sp_lstchg == 0) {
248 D(("need a new password"));
250 return PAM_NEW_AUTHTOK_REQD;
252 if (curdays < spent->sp_lstchg) {
253 pam_syslog(pamh, LOG_DEBUG,
254 "account %s has password changed in future",
258 if ((curdays - spent->sp_lstchg > spent->sp_max)
259 && (curdays - spent->sp_lstchg > spent->sp_inact)
260 && (curdays - spent->sp_lstchg > spent->sp_max + spent->sp_inact)
261 && (spent->sp_max != -1) && (spent->sp_inact != -1)) {
262 *daysleft = (int)((spent->sp_lstchg + spent->sp_max) - curdays);
263 D(("authtok expired"));
264 return PAM_AUTHTOK_EXPIRED;
266 if ((curdays - spent->sp_lstchg > spent->sp_max) && (spent->sp_max != -1)) {
267 D(("need a new password 2"));
268 return PAM_NEW_AUTHTOK_REQD;
270 if ((curdays - spent->sp_lstchg > spent->sp_max - spent->sp_warn)
271 && (spent->sp_max != -1) && (spent->sp_warn != -1)) {
272 *daysleft = (int)((spent->sp_lstchg + spent->sp_max) - curdays);
273 D(("warn before expiry"));
275 if ((curdays - spent->sp_lstchg < spent->sp_min)
276 && (spent->sp_min != -1)) {
278 * The last password change was too recent. This error will be ignored
279 * if no password change is attempted.
281 D(("password change too recent"));
282 return PAM_AUTHTOK_ERR;
287 /* passwd/salt conversion macros */
289 #define PW_TMPFILE "/etc/npasswd"
290 #define SH_TMPFILE "/etc/nshadow"
291 #define OPW_TMPFILE "/etc/security/nopasswd"
294 * i64c - convert an integer to a radix 64 character
307 if (i >= 2 && i <= 11)
308 return ('0' - 2 + i);
309 if (i >= 12 && i <= 37)
310 return ('A' - 12 + i);
311 if (i >= 38 && i <= 63)
312 return ('a' - 38 + i);
316 /* <where> must point to a buffer of at least <length>+1 length */
318 crypt_make_salt(char *where, int length)
322 unsigned char tmp[16];
323 unsigned char *src = (unsigned char *)where;
325 #ifdef PAM_PATH_RANDOMDEV
329 if ((rv = fd = open(PAM_PATH_RANDOMDEV, O_RDONLY)) != -1) {
330 while ((rv = read(fd, where, length)) != length && errno == EINTR);
336 * Code lifted from Marek Michalkiewicz's shadow suite. (CG)
337 * removed use of static variables (AGM)
339 * will work correctly only for length <= 16 */
342 gettimeofday(&tv, (struct timezone *) 0);
343 GoodMD5Update(&ctx, (void *) &tv, sizeof tv);
345 GoodMD5Update(&ctx, (void *) &i, sizeof i);
347 GoodMD5Update(&ctx, (void *) &i, sizeof i);
348 GoodMD5Update(&ctx, src, length);
349 GoodMD5Final(tmp, &ctx);
350 #ifdef PAM_PATH_RANDOMDEV
353 for (i = 0; i < length; i++)
354 *where++ = i64c(src[i] & 077);
359 crypt_md5_wrapper(const char *pass_new)
361 unsigned char result[16];
362 char *cp = (char *) result;
364 cp = stpcpy(cp, "$1$"); /* magic for the MD5 */
365 crypt_make_salt(cp, 8);
367 /* no longer need cleartext */
368 cp = Goodcrypt_md5(pass_new, (const char *) result);
374 PAMH_ARG_DECL(char * create_password_hash,
375 const char *password, unsigned int ctrl, int rounds)
378 char salt[64]; /* contains rounds number + max 16 bytes of salt + algo id */
381 if (on(UNIX_MD5_PASS, ctrl)) {
383 return crypt_md5_wrapper(password);
384 } else if (on(UNIX_BLOWFISH_PASS, ctrl)) {
386 } else if (on(UNIX_SHA256_PASS, ctrl)) {
388 } else if (on(UNIX_SHA512_PASS, ctrl)) {
390 } else { /* must be crypt/bigcrypt */
394 crypt_make_salt(salt, 2);
395 if (off(UNIX_BIGCRYPT, ctrl) && strlen(password) > 8) {
396 strncpy(tmppass, password, sizeof(tmppass)-1);
397 tmppass[sizeof(tmppass)-1] = '\0';
400 crypted = bigcrypt(password, salt);
401 memset(tmppass, '\0', sizeof(tmppass));
406 #ifdef HAVE_CRYPT_GENSALT_R
407 if (on(UNIX_BLOWFISH_PASS, ctrl)) {
409 crypt_make_salt(entropy, sizeof(entropy) - 1);
410 sp = crypt_gensalt_r (algoid, rounds,
411 entropy, sizeof(entropy),
415 sp = stpcpy(salt, algoid);
416 if (on(UNIX_ALGO_ROUNDS, ctrl)) {
417 sp += snprintf(sp, sizeof(salt) - 3, "rounds=%u$", rounds);
419 crypt_make_salt(sp, 8);
420 /* For now be conservative so the resulting hashes
421 * are not too long. 8 bytes of salt prevents dictionary
422 * attacks well enough. */
423 #ifdef HAVE_CRYPT_GENSALT_R
426 sp = crypt(password, salt);
427 if (strncmp(algoid, sp, strlen(algoid)) != 0) {
428 /* libxcrypt/libc doesn't know the algorithm, use MD5 */
429 pam_syslog(pamh, LOG_ERR,
430 "Algo %s not supported by the crypto backend, "
431 "falling back to MD5\n",
432 on(UNIX_BLOWFISH_PASS, ctrl) ? "blowfish" :
433 on(UNIX_SHA256_PASS, ctrl) ? "sha256" :
434 on(UNIX_SHA512_PASS, ctrl) ? "sha512" : algoid);
435 memset(sp, '\0', strlen(sp));
436 return crypt_md5_wrapper(password);
444 unix_selinux_confined(void)
446 static int confined = -1;
448 char tempfile[]="/etc/.pwdXXXXXX";
453 /* cannot be confined without SELinux enabled */
454 if (!SELINUX_ENABLED){
459 /* let's try opening shadow read only */
460 if ((fd=open("/etc/shadow", O_RDONLY)) != -1) {
466 if (errno == EACCES) {
471 /* shadow opening failed because of other reasons let's try
472 creating a file in /etc */
473 if ((fd=mkstemp(tempfile)) != -1) {
486 unix_selinux_confined(void)
499 #ifndef HELPER_COMPILE
500 if (unix_selinux_confined()) {
504 /* These values for the number of attempts and the sleep time
505 are, of course, completely arbitrary.
506 My reading of the PAM docs is that, once pam_chauthtok() has been
507 called with PAM_UPDATE_AUTHTOK, we are obliged to take any
508 reasonable steps to make sure the token is updated; so retrying
509 for 1/10 sec. isn't overdoing it. */
511 while((retval = lckpwdf()) != 0 && i < 100) {
516 return PAM_AUTHTOK_LOCK_BUSY;
524 #ifndef HELPER_COMPILE
525 if (unix_selinux_confined()) {
545 #ifdef HELPER_COMPILE
547 save_old_password(const char *forwho, const char *oldpass,
551 save_old_password(pam_handle_t *pamh, const char *forwho, const char *oldpass,
555 static char buf[16384];
556 static char nbuf[16384];
557 char *s_luser, *s_uid, *s_npas, *s_pas, *pass;
559 FILE *pwfile, *opwfile;
563 struct passwd *pwd = NULL;
566 security_context_t prev_context=NULL;
573 if (oldpass == NULL) {
577 oldmask = umask(077);
580 if (SELINUX_ENABLED) {
581 security_context_t passwd_context=NULL;
582 if (getfilecon("/etc/passwd",&passwd_context)<0) {
583 return PAM_AUTHTOK_ERR;
585 if (getfscreatecon(&prev_context)<0) {
586 freecon(passwd_context);
587 return PAM_AUTHTOK_ERR;
589 if (setfscreatecon(passwd_context)) {
590 freecon(passwd_context);
591 freecon(prev_context);
592 return PAM_AUTHTOK_ERR;
594 freecon(passwd_context);
597 pwfile = fopen(OPW_TMPFILE, "w");
599 if (pwfile == NULL) {
604 opwfile = fopen(OLD_PASSWORDS_FILE, "r");
605 if (opwfile == NULL) {
611 if (fstat(fileno(opwfile), &st) == -1) {
618 if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) {
624 if (fchmod(fileno(pwfile), st.st_mode) == -1) {
631 while (fgets(buf, 16380, opwfile)) {
632 if (!strncmp(buf, forwho, strlen(forwho))) {
637 buf[strlen(buf) - 1] = '\0';
638 s_luser = strtok_r(buf, ":", &sptr);
639 s_uid = strtok_r(NULL, ":", &sptr);
640 s_npas = strtok_r(NULL, ":", &sptr);
641 s_pas = strtok_r(NULL, ":", &sptr);
642 npas = strtol(s_npas, NULL, 10) + 1;
643 while (npas > howmany) {
644 s_pas = strpbrk(s_pas, ",");
649 pass = crypt_md5_wrapper(oldpass);
651 snprintf(nbuf, sizeof(nbuf), "%s:%s:%d:%s\n",
652 s_luser, s_uid, npas, pass);
654 snprintf(nbuf, sizeof(nbuf),"%s:%s:%d:%s,%s\n",
655 s_luser, s_uid, npas, s_pas, pass);
657 if (fputs(nbuf, pwfile) < 0) {
661 } else if (fputs(buf, pwfile) < 0) {
669 pwd = pam_modutil_getpwnam(pamh, forwho);
673 pass = crypt_md5_wrapper(oldpass);
674 snprintf(nbuf, sizeof(nbuf), "%s:%lu:1:%s\n",
675 forwho, (unsigned long)pwd->pw_uid, pass);
677 if (fputs(nbuf, pwfile) < 0) {
683 if (fflush(pwfile) || fsync(fileno(pwfile))) {
684 D(("fflush or fsync error writing entries to old passwords file: %m"));
688 if (fclose(pwfile)) {
689 D(("fclose error writing entries to old passwords file: %m"));
695 if (rename(OPW_TMPFILE, OLD_PASSWORDS_FILE))
699 if (SELINUX_ENABLED) {
700 if (setfscreatecon(prev_context)) {
704 freecon(prev_context);
712 return PAM_AUTHTOK_ERR;
716 PAMH_ARG_DECL(int unix_update_passwd,
717 const char *forwho, const char *towhat)
719 struct passwd *tmpent = NULL;
721 FILE *pwfile, *opwfile;
725 security_context_t prev_context=NULL;
728 oldmask = umask(077);
730 if (SELINUX_ENABLED) {
731 security_context_t passwd_context=NULL;
732 if (getfilecon("/etc/passwd",&passwd_context)<0) {
733 return PAM_AUTHTOK_ERR;
735 if (getfscreatecon(&prev_context)<0) {
736 freecon(passwd_context);
737 return PAM_AUTHTOK_ERR;
739 if (setfscreatecon(passwd_context)) {
740 freecon(passwd_context);
741 freecon(prev_context);
742 return PAM_AUTHTOK_ERR;
744 freecon(passwd_context);
747 pwfile = fopen(PW_TMPFILE, "w");
749 if (pwfile == NULL) {
754 opwfile = fopen("/etc/passwd", "r");
755 if (opwfile == NULL) {
761 if (fstat(fileno(opwfile), &st) == -1) {
768 if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) {
774 if (fchmod(fileno(pwfile), st.st_mode) == -1) {
781 tmpent = fgetpwent(opwfile);
783 if (!strcmp(tmpent->pw_name, forwho)) {
786 const char *const_charp;
789 assigned_passwd.const_charp = towhat;
791 tmpent->pw_passwd = assigned_passwd.charp;
794 if (putpwent(tmpent, pwfile)) {
795 D(("error writing entry to password file: %m"));
799 tmpent = fgetpwent(opwfile);
803 if (fflush(pwfile) || fsync(fileno(pwfile))) {
804 D(("fflush or fsync error writing entries to password file: %m"));
808 if (fclose(pwfile)) {
809 D(("fclose error writing entries to password file: %m"));
815 if (!rename(PW_TMPFILE, "/etc/passwd"))
817 LOG_NOTICE, "password changed for %s", forwho);
822 if (SELINUX_ENABLED) {
823 if (setfscreatecon(prev_context)) {
827 freecon(prev_context);
835 return PAM_AUTHTOK_ERR;
839 PAMH_ARG_DECL(int unix_update_shadow,
840 const char *forwho, char *towhat)
842 struct spwd *spwdent = NULL, *stmpent = NULL;
844 FILE *pwfile, *opwfile;
848 security_context_t prev_context=NULL;
851 spwdent = getspnam(forwho);
852 if (spwdent == NULL) {
853 return PAM_USER_UNKNOWN;
855 oldmask = umask(077);
858 if (SELINUX_ENABLED) {
859 security_context_t shadow_context=NULL;
860 if (getfilecon("/etc/shadow",&shadow_context)<0) {
861 return PAM_AUTHTOK_ERR;
863 if (getfscreatecon(&prev_context)<0) {
864 freecon(shadow_context);
865 return PAM_AUTHTOK_ERR;
867 if (setfscreatecon(shadow_context)) {
868 freecon(shadow_context);
869 freecon(prev_context);
870 return PAM_AUTHTOK_ERR;
872 freecon(shadow_context);
875 pwfile = fopen(SH_TMPFILE, "w");
877 if (pwfile == NULL) {
882 opwfile = fopen("/etc/shadow", "r");
883 if (opwfile == NULL) {
889 if (fstat(fileno(opwfile), &st) == -1) {
896 if (fchown(fileno(pwfile), st.st_uid, st.st_gid) == -1) {
902 if (fchmod(fileno(pwfile), st.st_mode) == -1) {
909 stmpent = fgetspent(opwfile);
912 if (!strcmp(stmpent->sp_namp, forwho)) {
913 stmpent->sp_pwdp = towhat;
914 stmpent->sp_lstchg = time(NULL) / (60 * 60 * 24);
916 D(("Set password %s for %s", stmpent->sp_pwdp, forwho));
919 if (putspent(stmpent, pwfile)) {
920 D(("error writing entry to shadow file: %m"));
925 stmpent = fgetspent(opwfile);
929 if (fflush(pwfile) || fsync(fileno(pwfile))) {
930 D(("fflush or fsync error writing entries to shadow file: %m"));
934 if (fclose(pwfile)) {
935 D(("fclose error writing entries to shadow file: %m"));
941 if (!rename(SH_TMPFILE, "/etc/shadow"))
943 LOG_NOTICE, "password changed for %s", forwho);
949 if (SELINUX_ENABLED) {
950 if (setfscreatecon(prev_context)) {
954 freecon(prev_context);
963 return PAM_AUTHTOK_ERR;
967 #ifdef HELPER_COMPILE
970 helper_verify_password(const char *name, const char *p, int nullok)
972 struct passwd *pwd = NULL;
976 retval = get_pwd_hash(name, &pwd, &salt);
978 if (pwd == NULL || salt == NULL) {
979 helper_log_err(LOG_WARNING, "check pass; user unknown");
980 retval = PAM_USER_UNKNOWN;
982 retval = verify_pwd_hash(p, salt, nullok);
986 _pam_overwrite(salt);
990 p = NULL; /* no longer needed here */
996 helper_log_err(int err, const char *format, ...)
1000 va_start(args, format);
1001 openlog(HELPER_COMPILE, LOG_CONS | LOG_PID, LOG_AUTHPRIV);
1002 vsyslog(err, format, args);
1008 su_sighandler(int sig)
1010 #ifndef SA_RESETHAND
1011 /* emulate the behaviour of the SA_RESETHAND flag */
1012 if ( sig == SIGILL || sig == SIGTRAP || sig == SIGBUS || sig = SIGSERV ) {
1013 struct sigaction sa;
1014 memset(&sa, '\0', sizeof(sa));
1015 sa.sa_handler = SIG_DFL;
1016 sigaction(sig, &sa, NULL);
1027 struct sigaction action; /* posix signal structure */
1030 * Setup signal handlers
1032 (void) memset((void *) &action, 0, sizeof(action));
1033 action.sa_handler = su_sighandler;
1035 action.sa_flags = SA_RESETHAND;
1037 (void) sigaction(SIGILL, &action, NULL);
1038 (void) sigaction(SIGTRAP, &action, NULL);
1039 (void) sigaction(SIGBUS, &action, NULL);
1040 (void) sigaction(SIGSEGV, &action, NULL);
1041 action.sa_handler = SIG_IGN;
1042 action.sa_flags = 0;
1043 (void) sigaction(SIGTERM, &action, NULL);
1044 (void) sigaction(SIGHUP, &action, NULL);
1045 (void) sigaction(SIGINT, &action, NULL);
1046 (void) sigaction(SIGQUIT, &action, NULL);
1050 getuidname(uid_t uid)
1053 static char username[256];
1059 strncpy(username, pw->pw_name, sizeof(username));
1060 username[sizeof(username) - 1] = '\0';
1066 read_passwords(int fd, int npass, char **passwords)
1073 rbytes = read(fd, passwords[i]+offset, MAXPASS-offset);
1076 if (errno == EINTR) continue;
1082 while (npass > 0 && (pptr=memchr(passwords[i]+offset, '\0', rbytes))
1084 rbytes -= pptr - (passwords[i]+offset) + 1;
1090 memcpy(passwords[i], pptr+1, rbytes);
1091 memset(pptr+1, '\0', rbytes);
1098 if (offset > 0 && npass > 0) {
1099 memset(passwords[i], '\0', offset);
1106 /* ****************************************************************** *
1107 * Copyright (c) Jan Rêkorajski 1999.
1108 * Copyright (c) Andrew G. Morgan 1996-8.
1109 * Copyright (c) Alex O. Yuriev, 1996.
1110 * Copyright (c) Cristian Gafton 1996.
1111 * Copyright (c) Red Hat, Inc. 1996, 2007, 2008.
1113 * Redistribution and use in source and binary forms, with or without
1114 * modification, are permitted provided that the following conditions
1116 * 1. Redistributions of source code must retain the above copyright
1117 * notice, and the entire permission notice in its entirety,
1118 * including the disclaimer of warranties.
1119 * 2. Redistributions in binary form must reproduce the above copyright
1120 * notice, this list of conditions and the following disclaimer in the
1121 * documentation and/or other materials provided with the distribution.
1122 * 3. The name of the author may not be used to endorse or promote
1123 * products derived from this software without specific prior
1124 * written permission.
1126 * ALTERNATIVELY, this product may be distributed under the terms of
1127 * the GNU Public License, in which case the provisions of the GPL are
1128 * required INSTEAD OF the above restrictions. (This clause is
1129 * necessary due to a potential bad interaction between the GPL and
1130 * the restrictions contained in a BSD-style copyright.)
1132 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
1133 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1134 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
1135 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
1136 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
1137 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
1138 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1139 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
1140 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
1141 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
1142 * OF THE POSSIBILITY OF SUCH DAMAGE.