source/nsswitch/pam_winbind.c

   1 /* pam_winbind module
   2
   3    Copyright Andrew Tridgell <tridge@samba.org> 2000
   4    Copyright Tim Potter <tpot@samba.org> 2000
   5    Copyright Andrew Bartlett <abartlet@samba.org> 2002
   6
   7    largely based on pam_userdb by Christian Gafton <gafton@redhat.com>
   8    also contains large slabs of code from pam_unix by Elliot Lee <sopwith@redhat.com>
   9    (see copyright below for full details)
  10 */
  11
  12 #include "pam_winbind.h"
  13
  14 /* prototypes from common.c */
  15 void init_request(struct winbindd_request *req,int rq_type);
  16 int write_sock(void *buffer, int count);
  17 int read_reply(struct winbindd_response *response);
  18
  19 /* data tokens */
  20
  21 #define MAX_PASSWD_TRIES        3
  22
  23 /* some syslogging */
  24 static void _pam_log(int err, const char *format, ...)
  25 {
  26         va_list args;
  27
  28         va_start(args, format);
  29         openlog(MODULE_NAME, LOG_CONS|LOG_PID, LOG_AUTH);
  30         vsyslog(err, format, args);
  31         va_end(args);
  32         closelog();
  33 }
  34
  35 static int _pam_parse(int argc, const char **argv)
  36 {
  37         int ctrl;
  38         /* step through arguments */
  39         for (ctrl = 0; argc-- > 0; ++argv) {
  40
  41                 /* generic options */
  42
  43                 if (!strcmp(*argv,"debug"))
  44                         ctrl |= WINBIND_DEBUG_ARG;
  45                 else if (!strcasecmp(*argv, "use_authtok"))
  46                         ctrl |= WINBIND_USE_AUTHTOK_ARG;
  47                 else if (!strcasecmp(*argv, "use_first_pass"))
  48                         ctrl |= WINBIND_USE_FIRST_PASS_ARG;
  49                 else if (!strcasecmp(*argv, "try_first_pass"))
  50                         ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
  51                 else if (!strcasecmp(*argv, "unknown_ok"))
  52                         ctrl |= WINBIND_UNKNOWN_OK_ARG;
  53                 else {
  54                         _pam_log(LOG_ERR, "pam_parse: unknown option; %s", *argv);
  55                 }
  56         }
  57
  58         return ctrl;
  59 }
  60
  61 /* --- authentication management functions --- */
  62
  63 /* Attempt a conversation */
  64
  65 static int converse(pam_handle_t *pamh, int nargs,
  66                     struct pam_message **message,
  67                     struct pam_response **response)
  68 {
  69     int retval;
  70     struct pam_conv *conv;
  71
  72     retval = pam_get_item(pamh, PAM_CONV, (const void **) &conv ) ;
  73     if (retval == PAM_SUCCESS) {
  74         retval = conv->conv(nargs, (const struct pam_message **)message,
  75                             response, conv->appdata_ptr);
  76     }
  77
  78     return retval; /* propagate error status */
  79 }
  80
  81
  82 static int _make_remark(pam_handle_t * pamh, int type, const char *text)
  83 {
  84         int retval = PAM_SUCCESS;
  85
  86         struct pam_message *pmsg[1], msg[1];
  87         struct pam_response *resp;
  88
  89         pmsg[0] = &msg[0];
  90         msg[0].msg = text;
  91         msg[0].msg_style = type;
  92
  93         resp = NULL;
  94         retval = converse(pamh, 1, pmsg, &resp);
  95
  96         if (resp) {
  97                 _pam_drop_reply(resp, 1);
  98         }
  99         return retval;
 100 }
 101
 102 static int winbind_request(enum winbindd_cmd req_type,
 103                            struct winbindd_request *request,
 104                            struct winbindd_response *response)
 105 {
 106         /* Fill in request and send down pipe */
 107         init_request(request, req_type);
 108
 109         if (write_sock(request, sizeof(*request)) == -1) {
 110                 _pam_log(LOG_ERR, "write to socket failed!");
 111                 return PAM_SERVICE_ERR;
 112         }
 113
 114         /* Wait for reply */
 115         if (read_reply(response) == -1) {
 116                 _pam_log(LOG_ERR, "read from socket failed!");
 117                 return PAM_SERVICE_ERR;
 118         }
 119
 120         /* Copy reply data from socket */
 121         if (response->result != WINBINDD_OK) {
 122                 if (response->data.auth.pam_error != PAM_SUCCESS) {
 123                         _pam_log(LOG_ERR, "request failed, PAM error was %d, NT error was %s",
 124                                  response->data.auth.pam_error,
 125                                  response->data.auth.nt_status_string);
 126                         return response->data.auth.pam_error;
 127                 } else {
 128                         _pam_log(LOG_ERR, "request failed, but PAM error 0!");
 129                         return PAM_SERVICE_ERR;
 130                 }
 131         }
 132
 133         return PAM_SUCCESS;
 134 }
 135
 136 /* talk to winbindd */
 137 static int winbind_auth_request(const char *user, const char *pass, int ctrl)
 138 {
 139         struct winbindd_request request;
 140         struct winbindd_response response;
 141         int retval;
 142
 143         ZERO_STRUCT(request);
 144
 145         strncpy(request.data.auth.user, user,
 146                 sizeof(request.data.auth.user)-1);
 147
 148         strncpy(request.data.auth.pass, pass,
 149                 sizeof(request.data.auth.pass)-1);
 150
 151         retval = winbind_request(WINBINDD_PAM_AUTH, &request, &response);
 152
 153         switch (retval) {
 154         case PAM_AUTH_ERR:
 155                 /* incorrect password */
 156                 _pam_log(LOG_WARNING, "user `%s' denied access (incorrect password)", user);
 157                 return retval;
 158         case PAM_ACCT_EXPIRED:
 159                 /* account expired */
 160                 _pam_log(LOG_WARNING, "user `%s' account expired", user);
 161                 return retval;
 162         case PAM_AUTHTOK_EXPIRED:
 163                 /* password expired */
 164                 _pam_log(LOG_WARNING, "user `%s' password expired", user);
 165                 return retval;
 166         case PAM_NEW_AUTHTOK_REQD:
 167                 /* password expired */
 168                 _pam_log(LOG_WARNING, "user `%s' new password required", user);
 169                 return retval;
 170         case PAM_USER_UNKNOWN:
 171                 /* the user does not exist */
 172                 if (ctrl & WINBIND_DEBUG_ARG)
 173                         _pam_log(LOG_NOTICE, "user `%s' not found",
 174                                  user);
 175                 if (ctrl & WINBIND_UNKNOWN_OK_ARG) {
 176                         return PAM_IGNORE;
 177                 }
 178                 return retval;
 179         case PAM_SUCCESS:
 180                 /* Otherwise, the authentication looked good */
 181                 _pam_log(LOG_NOTICE, "user '%s' granted acces", user);
 182                 return retval;
 183         default:
 184                 /* we don't know anything about this return value */
 185                 _pam_log(LOG_ERR, "internal module error (retval = %d, user = `%s'",
 186                          retval, user);
 187                 return retval;
 188         }
 189      /* should not be reached */
 190 }
 191
 192 /* talk to winbindd */
 193 static int winbind_chauthtok_request(const char *user, const char *oldpass,
 194                                      const char *newpass)
 195 {
 196         struct winbindd_request request;
 197         struct winbindd_response response;
 198
 199         ZERO_STRUCT(request);
 200
 201         if (request.data.chauthtok.user == NULL) return -2;
 202
 203         strncpy(request.data.chauthtok.user, user,
 204                 sizeof(request.data.chauthtok.user) - 1);
 205
 206         if (oldpass != NULL) {
 207             strncpy(request.data.chauthtok.oldpass, oldpass,
 208                     sizeof(request.data.chauthtok.oldpass) - 1);
 209         } else {
 210             request.data.chauthtok.oldpass[0] = '\0';
 211         }
 212
 213         if (newpass != NULL) {
 214             strncpy(request.data.chauthtok.newpass, newpass,
 215                     sizeof(request.data.chauthtok.newpass) - 1);
 216         } else {
 217             request.data.chauthtok.newpass[0] = '\0';
 218         }
 219
 220         return winbind_request(WINBINDD_PAM_CHAUTHTOK, &request, &response);
 221 }
 222
 223 /*
 224  * Checks if a user has an account
 225  *
 226  * return values:
 227  *       1  = User not found
 228  *       0  = OK
 229  *      -1  = System error
 230  */
 231 static int valid_user(const char *user)
 232 {
 233         if (getpwnam(user)) return 0;
 234         return 1;
 235 }
 236
 237 static char *_pam_delete(register char *xx)
 238 {
 239     _pam_overwrite(xx);
 240     _pam_drop(xx);
 241     return NULL;
 242 }
 243
 244 /*
 245  * obtain a password from the user
 246  */
 247
 248 static int _winbind_read_password(pam_handle_t * pamh
 249                                   ,unsigned int ctrl
 250                                   ,const char *comment
 251                                   ,const char *prompt1
 252                                   ,const char *prompt2
 253                                   ,const char **pass)
 254 {
 255         int authtok_flag;
 256         int retval;
 257         const char *item;
 258         char *token;
 259
 260         /*
 261          * make sure nothing inappropriate gets returned
 262          */
 263
 264         *pass = token = NULL;
 265
 266         /*
 267          * which authentication token are we getting?
 268          */
 269
 270         authtok_flag = on(WINBIND__OLD_PASSWORD, ctrl) ? PAM_OLDAUTHTOK : PAM_AUTHTOK;
 271
 272         /*
 273          * should we obtain the password from a PAM item ?
 274          */
 275
 276         if (on(WINBIND_TRY_FIRST_PASS_ARG, ctrl) || on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
 277                 retval = pam_get_item(pamh, authtok_flag, (const void **) &item);
 278                 if (retval != PAM_SUCCESS) {
 279                         /* very strange. */
 280                         _pam_log(LOG_ALERT,
 281                                  "pam_get_item returned error to unix-read-password"
 282                             );
 283                         return retval;
 284                 } else if (item != NULL) {      /* we have a password! */
 285                         *pass = item;
 286                         item = NULL;
 287                         return PAM_SUCCESS;
 288                 } else if (on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
 289                         return PAM_AUTHTOK_RECOVER_ERR;         /* didn't work */
 290                 } else if (on(WINBIND_USE_AUTHTOK_ARG, ctrl)
 291                            && off(WINBIND__OLD_PASSWORD, ctrl)) {
 292                         return PAM_AUTHTOK_RECOVER_ERR;
 293                 }
 294         }
 295         /*
 296          * getting here implies we will have to get the password from the
 297          * user directly.
 298          */
 299
 300         {
 301                 struct pam_message msg[3], *pmsg[3];
 302                 struct pam_response *resp;
 303                 int i, replies;
 304
 305                 /* prepare to converse */
 306
 307                 if (comment != NULL) {
 308                         pmsg[0] = &msg[0];
 309                         msg[0].msg_style = PAM_TEXT_INFO;
 310                         msg[0].msg = comment;
 311                         i = 1;
 312                 } else {
 313                         i = 0;
 314                 }
 315
 316                 pmsg[i] = &msg[i];
 317                 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
 318                 msg[i++].msg = prompt1;
 319                 replies = 1;
 320
 321                 if (prompt2 != NULL) {
 322                         pmsg[i] = &msg[i];
 323                         msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
 324                         msg[i++].msg = prompt2;
 325                         ++replies;
 326                 }
 327                 /* so call the conversation expecting i responses */
 328                 resp = NULL;
 329                 retval = converse(pamh, i, pmsg, &resp);
 330
 331                 if (resp != NULL) {
 332
 333                         /* interpret the response */
 334
 335                         if (retval == PAM_SUCCESS) {    /* a good conversation */
 336
 337                                 token = x_strdup(resp[i - replies].resp);
 338                                 if (token != NULL) {
 339                                         if (replies == 2) {
 340
 341                                                 /* verify that password entered correctly */
 342                                                 if (!resp[i - 1].resp
 343                                                     || strcmp(token, resp[i - 1].resp)) {
 344                                                         _pam_delete(token);     /* mistyped */
 345                                                         retval = PAM_AUTHTOK_RECOVER_ERR;
 346                                                         _make_remark(pamh                                                                   ,PAM_ERROR_MSG, MISTYPED_PASS);
 347                                                 }
 348                                         }
 349                                 } else {
 350                                         _pam_log(LOG_NOTICE
 351                                                  ,"could not recover authentication token");
 352                                 }
 353
 354                         }
 355                         /*
 356                          * tidy up the conversation (resp_retcode) is ignored
 357                          * -- what is it for anyway? AGM
 358                          */
 359
 360                         _pam_drop_reply(resp, i);
 361
 362                 } else {
 363                         retval = (retval == PAM_SUCCESS)
 364                             ? PAM_AUTHTOK_RECOVER_ERR : retval;
 365                 }
 366         }
 367
 368         if (retval != PAM_SUCCESS) {
 369                 if (on(WINBIND_DEBUG_ARG, ctrl))
 370                         _pam_log(LOG_DEBUG,
 371                                  "unable to obtain a password");
 372                 return retval;
 373         }
 374         /* 'token' is the entered password */
 375
 376         /* we store this password as an item */
 377
 378         retval = pam_set_item(pamh, authtok_flag, token);
 379         _pam_delete(token);     /* clean it up */
 380         if (retval != PAM_SUCCESS
 381             || (retval = pam_get_item(pamh, authtok_flag
 382                                       ,(const void **) &item))
 383             != PAM_SUCCESS) {
 384
 385                 _pam_log(LOG_CRIT, "error manipulating password");
 386                 return retval;
 387
 388         }
 389
 390         *pass = item;
 391         item = NULL;            /* break link to password */
 392
 393         return PAM_SUCCESS;
 394 }
 395
 396 PAM_EXTERN
 397 int pam_sm_authenticate(pam_handle_t *pamh, int flags,
 398                         int argc, const char **argv)
 399 {
 400      const char *username;
 401      const char *password;
 402      int retval = PAM_AUTH_ERR;
 403
 404      /* parse arguments */
 405      int ctrl = _pam_parse(argc, argv);
 406
 407      /* Get the username */
 408      retval = pam_get_user(pamh, &username, NULL);
 409      if ((retval != PAM_SUCCESS) || (!username)) {
 410         if (ctrl & WINBIND_DEBUG_ARG)
 411             _pam_log(LOG_DEBUG,"can not get the username");
 412         return PAM_SERVICE_ERR;
 413      }
 414
 415      retval = _winbind_read_password(pamh, ctrl, NULL,
 416                                      "Password: ", NULL,
 417                                      &password);
 418
 419      if (retval != PAM_SUCCESS) {
 420          _pam_log(LOG_ERR, "Could not retrieve user's password");
 421          return PAM_AUTHTOK_ERR;
 422      }
 423
 424      if (ctrl & WINBIND_DEBUG_ARG) {
 425
 426              /* Let's not give too much away in the log file */
 427
 428 #ifdef DEBUG_PASSWORD
 429          _pam_log(LOG_INFO, "Verify user `%s' with password `%s'",
 430                   username, password);
 431 #else
 432          _pam_log(LOG_INFO, "Verify user `%s'", username);
 433 #endif
 434      }
 435
 436      /* Now use the username to look up password */
 437      return winbind_auth_request(username, password, ctrl);
 438 }
 439
 440 PAM_EXTERN
 441 int pam_sm_setcred(pam_handle_t *pamh, int flags,
 442                    int argc, const char **argv)
 443 {
 444     return PAM_SUCCESS;
 445 }
 446
 447 /*
 448  * Account management. We want to verify that the account exists
 449  * before returning PAM_SUCCESS
 450  */
 451 PAM_EXTERN
 452 int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
 453                    int argc, const char **argv)
 454 {
 455     const char *username;
 456     int retval = PAM_USER_UNKNOWN;
 457
 458     /* parse arguments */
 459     int ctrl = _pam_parse(argc, argv);
 460
 461     /* Get the username */
 462     retval = pam_get_user(pamh, &username, NULL);
 463     if ((retval != PAM_SUCCESS) || (!username)) {
 464         if (ctrl & WINBIND_DEBUG_ARG)
 465             _pam_log(LOG_DEBUG,"can not get the username");
 466         return PAM_SERVICE_ERR;
 467     }
 468
 469     /* Verify the username */
 470     retval = valid_user(username);
 471     switch (retval) {
 472         case -1:
 473             /* some sort of system error. The log was already printed */
 474             return PAM_SERVICE_ERR;
 475         case 1:
 476             /* the user does not exist */
 477             if (ctrl & WINBIND_DEBUG_ARG)
 478                 _pam_log(LOG_NOTICE, "user `%s' not found",
 479                          username);
 480             if (ctrl & WINBIND_UNKNOWN_OK_ARG)
 481                 return PAM_IGNORE;
 482             return PAM_USER_UNKNOWN;
 483         case 0:
 484             /* Otherwise, the authentication looked good */
 485             _pam_log(LOG_NOTICE, "user '%s' granted acces", username);
 486             return PAM_SUCCESS;
 487         default:
 488             /* we don't know anything about this return value */
 489             _pam_log(LOG_ERR, "internal module error (retval = %d, user = `%s'",
 490                      retval, username);
 491             return PAM_SERVICE_ERR;
 492     }
 493
 494     /* should not be reached */
 495     return PAM_IGNORE;
 496 }
 497 PAM_EXTERN
 498 int pam_sm_open_session(pam_handle_t *pamh, int flags,
 499                 int argc, const char **argv)
 500 {
 501         /* parse arguments */
 502         int ctrl = _pam_parse(argc, argv);
 503         if (ctrl & WINBIND_DEBUG_ARG)
 504               _pam_log(LOG_DEBUG,"libpam_winbind:pam_sm_open_session handler");
 505         return PAM_SUCCESS;
 506 }
 507 PAM_EXTERN
 508 int pam_sm_close_session(pam_handle_t *pamh, int flags,
 509                 int argc, const char **argv)
 510 {
 511         /* parse arguments */
 512         int ctrl = _pam_parse(argc, argv);
 513         if (ctrl & WINBIND_DEBUG_ARG)
 514               _pam_log(LOG_DEBUG,"libpam_winbind:pam_sm_close_session handler");
 515         return PAM_SUCCESS;
 516 }
 517
 518
 519
 520 PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
 521                                 int argc, const char **argv)
 522 {
 523         unsigned int lctrl;
 524         int retval;
 525         unsigned int ctrl = _pam_parse(argc, argv);
 526
 527         /* <DO NOT free() THESE> */
 528         const char *user;
 529         char *pass_old, *pass_new;
 530         /* </DO NOT free() THESE> */
 531
 532         char *Announce;
 533
 534         int retry = 0;
 535
 536         /*
 537          * First get the name of a user
 538          */
 539         retval = pam_get_user(pamh, &user, "Username: ");
 540         if (retval == PAM_SUCCESS) {
 541                 if (user == NULL) {
 542                         _pam_log(LOG_ERR, "username was NULL!");
 543                         return PAM_USER_UNKNOWN;
 544                 }
 545                 if (retval == PAM_SUCCESS && on(WINBIND_DEBUG_ARG, ctrl))
 546                         _pam_log(LOG_DEBUG, "username [%s] obtained",
 547                                  user);
 548         } else {
 549                 if (on(WINBIND_DEBUG_ARG, ctrl))
 550                         _pam_log(LOG_DEBUG,
 551                                  "password - could not identify user");
 552                 return retval;
 553         }
 554
 555         /*
 556          * obtain and verify the current password (OLDAUTHTOK) for
 557          * the user.
 558          */
 559
 560         if (flags & PAM_PRELIM_CHECK) {
 561
 562                 /* instruct user what is happening */
 563 #define greeting "Changing password for "
 564                 Announce = (char *) malloc(sizeof(greeting) + strlen(user));
 565                 if (Announce == NULL) {
 566                 _pam_log(LOG_CRIT,
 567                          "password - out of memory");
 568                 return PAM_BUF_ERR;
 569                 }
 570                 (void) strcpy(Announce, greeting);
 571                 (void) strcpy(Announce + sizeof(greeting) - 1, user);
 572 #undef greeting
 573
 574                 lctrl = ctrl | WINBIND__OLD_PASSWORD;
 575                 retval = _winbind_read_password(pamh, lctrl
 576                                                 ,Announce
 577                                                 ,"(current) NT password: "
 578                                                 ,NULL
 579                                                 ,(const char **) &pass_old);
 580                 free(Announce);
 581
 582                 if (retval != PAM_SUCCESS) {
 583                         _pam_log(LOG_NOTICE
 584                                  ,"password - (old) token not obtained");
 585                         return retval;
 586                 }
 587                 /* verify that this is the password for this user */
 588
 589                 retval = winbind_auth_request(user, pass_old, ctrl);
 590
 591                 if (retval != PAM_ACCT_EXPIRED
 592                     && retval != PAM_AUTHTOK_EXPIRED
 593                     && retval != PAM_NEW_AUTHTOK_REQD
 594                     && retval != PAM_SUCCESS) {
 595                         pass_old = NULL;
 596                         return retval;
 597                 }
 598
 599                 retval = pam_set_item(pamh, PAM_OLDAUTHTOK, (const void *) pass_old);
 600                 pass_old = NULL;
 601                 if (retval != PAM_SUCCESS) {
 602                         _pam_log(LOG_CRIT,
 603                                  "failed to set PAM_OLDAUTHTOK");
 604                 }
 605         } else if (flags & PAM_UPDATE_AUTHTOK) {
 606
 607                 /*
 608                  * obtain the proposed password
 609                  */
 610
 611                 /*
 612                  * get the old token back.
 613                  */
 614
 615                 retval = pam_get_item(pamh, PAM_OLDAUTHTOK
 616                                       ,(const void **) &pass_old);
 617
 618                 if (retval != PAM_SUCCESS) {
 619                         _pam_log(LOG_NOTICE, "user not authenticated");
 620                         return retval;
 621                 }
 622
 623                 lctrl = ctrl;
 624
 625                 if (on(WINBIND_USE_AUTHTOK_ARG, lctrl)) {
 626                         ctrl = WINBIND_USE_FIRST_PASS_ARG | lctrl;
 627                 }
 628                 retry = 0;
 629                 retval = PAM_AUTHTOK_ERR;
 630                 while ((retval != PAM_SUCCESS) && (retry++ < MAX_PASSWD_TRIES)) {
 631                         /*
 632                          * use_authtok is to force the use of a previously entered
 633                          * password -- needed for pluggable password strength checking
 634                          */
 635
 636                         retval = _winbind_read_password(pamh, lctrl
 637                                                         ,NULL
 638                                                         ,"Enter new NT password: "
 639                                                         ,"Retype new NT password: "
 640                                                         ,(const char **) &pass_new);
 641
 642                         if (retval != PAM_SUCCESS) {
 643                                 if (on(WINBIND_DEBUG_ARG, ctrl)) {
 644                                         _pam_log(LOG_ALERT
 645                                                  ,"password - new password not obtained");
 646                                 }
 647                                 pass_old = NULL;/* tidy up */
 648                                 return retval;
 649                         }
 650
 651                         /*
 652                          * At this point we know who the user is and what they
 653                          * propose as their new password. Verify that the new
 654                          * password is acceptable.
 655                          */
 656
 657                         if (pass_new[0] == '\0') {/* "\0" password = NULL */
 658                                 pass_new = NULL;
 659                         }
 660                 }
 661
 662                 /*
 663                  * By reaching here we have approved the passwords and must now
 664                  * rebuild the password database file.
 665                  */
 666
 667                 retval = winbind_chauthtok_request(user, pass_old, pass_new);
 668                 _pam_overwrite(pass_new);
 669                 _pam_overwrite(pass_old);
 670                 pass_old = pass_new = NULL;
 671         } else {
 672                 retval = PAM_SERVICE_ERR;
 673         }
 674
 675         return retval;
 676 }
 677
 678 #ifdef PAM_STATIC
 679
 680 /* static module data */
 681
 682 struct pam_module _pam_winbind_modstruct = {
 683      MODULE_NAME,
 684      pam_sm_authenticate,
 685      pam_sm_setcred,
 686      pam_sm_acct_mgmt,
 687      pam_sm_open_session,
 688      pam_sm_close_session,
 689      pam_sm_chauthtok
 690 };
 691
 692 #endif
 693
 694 /*
 695  * Copyright (c) Andrew Tridgell  <tridge@samba.org>   2000
 696  * Copyright (c) Tim Potter       <tpot@samba.org>     2000
 697  * Copyright (c) Andrew Bartlettt <abartlet@samba.org> 2002
 698  * Copyright (c) Jan Rêkorajski 1999.
 699  * Copyright (c) Andrew G. Morgan 1996-8.
 700  * Copyright (c) Alex O. Yuriev, 1996.
 701  * Copyright (c) Cristian Gafton 1996.
 702  * Copyright (C) Elliot Lee <sopwith@redhat.com> 1996, Red Hat Software.
 703  *
 704  * Redistribution and use in source and binary forms, with or without
 705  * modification, are permitted provided that the following conditions
 706  * are met:
 707  * 1. Redistributions of source code must retain the above copyright
 708  *    notice, and the entire permission notice in its entirety,
 709  *    including the disclaimer of warranties.
 710  * 2. Redistributions in binary form must reproduce the above copyright
 711  *    notice, this list of conditions and the following disclaimer in the
 712  *    documentation and/or other materials provided with the distribution.
 713  * 3. The name of the author may not be used to endorse or promote
 714  *    products derived from this software without specific prior
 715  *    written permission.
 716  *
 717  * ALTERNATIVELY, this product may be distributed under the terms of
 718  * the GNU Public License, in which case the provisions of the GPL are
 719  * required INSTEAD OF the above restrictions.  (This clause is
 720  * necessary due to a potential bad interaction between the GPL and
 721  * the restrictions contained in a BSD-style copyright.)
 722  *
 723  * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
 724  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 725  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 726  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
 727  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 728  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 729  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 730  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 731  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 732  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 733  * OF THE POSSIBILITY OF SUCH DAMAGE.
 734  */