1 /* 2 * Copyright (c) 1983, 1988, 1989 The Regents of the University of California. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms are permitted 6 * provided that the above copyright notice and this paragraph are 7 * duplicated in all such forms and that any documentation, 8 * advertising materials, and other materials related to such 9 * distribution and use acknowledge that the software was developed 10 * by the University of California, Berkeley. The name of the 11 * University may not be used to endorse or promote products derived 12 * from this software without specific prior written permission. 13 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 14 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 15 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 16 */ 17 18 #ifndef lint 19 char copyright[] = 20 "@(#) Copyright (c) 1983, 1988, 1989 The Regents of the University of California.\n\ 21 All rights reserved.\n"; 22 #endif /* not lint */ 23 24 #ifndef lint 25 static char sccsid[] = "@(#)rlogind.c 5.43 (Berkeley) 05/21/90"; 26 #endif /* not lint */ 27 28 #ifdef KERBEROS 29 /* From: 30 * $Source: /mit/kerberos/ucb/mit/rlogind/RCS/rlogind.c,v $ 31 * $Header: rlogind.c,v 5.0 89/06/26 18:31:01 kfall Locked $ 32 */ 33 #endif 34 35 /* 36 * remote login server: 37 * \0 38 * remuser\0 39 * locuser\0 40 * terminal_type/speed\0 41 * data 42 */ 43 44 #define FD_SETSIZE 16 /* don't need many bits for select */ 45 #include <sys/param.h> 46 #include <sys/stat.h> 47 #include <sys/socket.h> 48 #include <sys/wait.h> 49 #include <sys/file.h> 50 #include <sys/signal.h> 51 #include <sys/ioctl.h> 52 #include <sys/termios.h> 53 54 #include <netinet/in.h> 55 56 #include <errno.h> 57 #include <pwd.h> 58 #include <netdb.h> 59 #include <syslog.h> 60 #include <string.h> 61 #include <stdio.h> 62 #include <unistd.h> 63 #include "pathnames.h" 64 65 #ifndef TIOCPKT_WINDOW 66 #define TIOCPKT_WINDOW 0x80 67 #endif 68 69 #ifdef KERBEROS 70 #include <kerberosIV/des.h> 71 #include <kerberosIV/krb.h> 72 #define SECURE_MESSAGE "This rlogin session is using DES encryption for all transmissions.\r\n" 73 74 AUTH_DAT *kdata; 75 KTEXT ticket; 76 u_char auth_buf[sizeof(AUTH_DAT)]; 77 u_char tick_buf[sizeof(KTEXT_ST)]; 78 Key_schedule schedule; 79 int encrypt = 0, retval, use_kerberos = 0, vacuous = 0; 80 81 #define ARGSTR "alnkvx" 82 #else 83 #define ARGSTR "aln" 84 #endif /* KERBEROS */ 85 86 char *env[2]; 87 #define NMAX 30 88 char lusername[NMAX+1], rusername[NMAX+1]; 89 static char term[64] = "TERM="; 90 #define ENVSIZE (sizeof("TERM=")-1) /* skip null for concatenation */ 91 int keepalive = 1; 92 int check_all = 0; 93 94 extern int errno; 95 int reapchild(); 96 struct passwd *getpwnam(), *pwd; 97 char *malloc(); 98 99 main(argc, argv) 100 int argc; 101 char **argv; 102 { 103 extern int opterr, optind; 104 extern int _check_rhosts_file; 105 int ch; 106 int on = 1, fromlen; 107 struct sockaddr_in from; 108 109 openlog("rlogind", LOG_PID | LOG_CONS, LOG_AUTH); 110 111 opterr = 0; 112 while ((ch = getopt(argc, argv, ARGSTR)) != EOF) 113 switch (ch) { 114 case 'a': 115 check_all = 1; 116 break; 117 case 'l': 118 _check_rhosts_file = 0; 119 break; 120 case 'n': 121 keepalive = 0; 122 break; 123 #ifdef KERBEROS 124 case 'k': 125 use_kerberos = 1; 126 break; 127 case 'v': 128 vacuous = 1; 129 break; 130 case 'x': 131 encrypt = 1; 132 break; 133 #endif 134 case '?': 135 default: 136 usage(); 137 break; 138 } 139 argc -= optind; 140 argv += optind; 141 142 #ifdef KERBEROS 143 if (use_kerberos && vacuous) { 144 usage(); 145 fatal(STDERR_FILENO, "only one of -k and -v allowed", 0); 146 } 147 #endif 148 fromlen = sizeof (from); 149 if (getpeername(0, &from, &fromlen) < 0) { 150 syslog(LOG_ERR,"Can't get peer name of remote host: %m"); 151 fatal(STDERR_FILENO, "Can't get peer name of remote host", 1); 152 } 153 if (keepalive && 154 setsockopt(0, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof (on)) < 0) 155 syslog(LOG_WARNING, "setsockopt (SO_KEEPALIVE): %m"); 156 doit(0, &from); 157 } 158 159 int child; 160 int cleanup(); 161 int netf; 162 char *line; 163 int confirmed; 164 extern char *inet_ntoa(); 165 166 struct winsize win = { 0, 0, 0, 0 }; 167 168 169 doit(f, fromp) 170 int f; 171 struct sockaddr_in *fromp; 172 { 173 int i, p, t, pid, on = 1; 174 int authenticated = 0, hostok = 0; 175 register struct hostent *hp; 176 char remotehost[2 * MAXHOSTNAMELEN + 1]; 177 struct hostent hostent; 178 char c; 179 180 alarm(60); 181 read(f, &c, 1); 182 183 if (c != 0) 184 exit(1); 185 #ifdef KERBEROS 186 if (vacuous) 187 fatal(f, "Remote host requires Kerberos authentication", 0); 188 #endif 189 190 alarm(0); 191 fromp->sin_port = ntohs((u_short)fromp->sin_port); 192 hp = gethostbyaddr(&fromp->sin_addr, sizeof (struct in_addr), 193 fromp->sin_family); 194 if (hp == 0) { 195 /* 196 * Only the name is used below. 197 */ 198 hp = &hostent; 199 hp->h_name = inet_ntoa(fromp->sin_addr); 200 hostok++; 201 } else if (check_all || local_domain(hp->h_name)) { 202 /* 203 * If name returned by gethostbyaddr is in our domain, 204 * attempt to verify that we haven't been fooled by someone 205 * in a remote net; look up the name and check that this 206 * address corresponds to the name. 207 */ 208 strncpy(remotehost, hp->h_name, sizeof(remotehost) - 1); 209 remotehost[sizeof(remotehost) - 1] = 0; 210 hp = gethostbyname(remotehost); 211 if (hp) 212 for (; hp->h_addr_list[0]; hp->h_addr_list++) 213 if (!bcmp(hp->h_addr_list[0], (caddr_t)&fromp->sin_addr, 214 sizeof(fromp->sin_addr))) { 215 hostok++; 216 break; 217 } 218 } else 219 hostok++; 220 221 #ifdef KERBEROS 222 if (use_kerberos) { 223 if (!hostok) 224 fatal(f, "krlogind: Host address mismatch.", 0); 225 retval = do_krb_login(hp->h_name, fromp, encrypt); 226 if (retval == 0) 227 authenticated++; 228 else if (retval > 0) 229 fatal(f, krb_err_txt[retval], 0); 230 write(f, &c, 1); 231 confirmed = 1; /* we sent the null! */ 232 } else 233 #endif 234 { 235 if (fromp->sin_family != AF_INET || 236 fromp->sin_port >= IPPORT_RESERVED || 237 fromp->sin_port < IPPORT_RESERVED/2) { 238 syslog(LOG_NOTICE, "Connection from %s on illegal port", 239 inet_ntoa(fromp->sin_addr)); 240 fatal(f, "Permission denied", 0); 241 } 242 #ifdef IP_OPTIONS 243 { 244 u_char optbuf[BUFSIZ/3], *cp; 245 char lbuf[BUFSIZ], *lp; 246 int optsize = sizeof(optbuf), ipproto; 247 struct protoent *ip; 248 249 if ((ip = getprotobyname("ip")) != NULL) 250 ipproto = ip->p_proto; 251 else 252 ipproto = IPPROTO_IP; 253 if (getsockopt(0, ipproto, IP_OPTIONS, (char *)optbuf, 254 &optsize) == 0 && optsize != 0) { 255 lp = lbuf; 256 for (cp = optbuf; optsize > 0; cp++, optsize--, lp += 3) 257 sprintf(lp, " %2.2x", *cp); 258 syslog(LOG_NOTICE, 259 "Connection received using IP options (ignored):%s", 260 lbuf); 261 if (setsockopt(0, ipproto, IP_OPTIONS, 262 (char *)NULL, &optsize) != 0) { 263 syslog(LOG_ERR, "setsockopt IP_OPTIONS NULL: %m"); 264 exit(1); 265 } 266 } 267 } 268 #endif 269 if (do_rlogin(hp->h_name) == 0 && hostok) 270 authenticated++; 271 } 272 273 for (c = 'p'; c <= 's'; c++) { 274 struct stat stb; 275 line = "/dev/ptyXX"; 276 line[strlen("/dev/pty")] = c; 277 line[strlen("/dev/ptyp")] = '0'; 278 if (stat(line, &stb) < 0) 279 break; 280 for (i = 0; i < 16; i++) { 281 line[sizeof("/dev/ptyp") - 1] = "0123456789abcdef"[i]; 282 p = open(line, O_RDWR); 283 if (p > 0) 284 goto gotpty; 285 } 286 } 287 fatal(f, "Out of ptys", 0); 288 /*NOTREACHED*/ 289 gotpty: 290 (void) ioctl(p, TIOCSWINSZ, &win); 291 netf = f; 292 line[sizeof(_PATH_DEV) - 1] = 't'; 293 t = open(line, O_RDWR); 294 if (t < 0) 295 fatal(f, line, 1); 296 if (fchmod(t, 0)) 297 fatal(f, line, 1); 298 (void)signal(SIGHUP, SIG_IGN); 299 vhangup(); 300 (void)signal(SIGHUP, SIG_DFL); 301 t = open(line, O_RDWR); 302 if (t < 0) 303 fatal(f, line, 1); 304 setup_term(t); 305 if (confirmed == 0) { 306 write(f, "", 1); 307 confirmed = 1; /* we sent the null! */ 308 } 309 #ifdef KERBEROS 310 if (encrypt) 311 (void) des_write(f, SECURE_MESSAGE, sizeof(SECURE_MESSAGE)); 312 313 if (use_kerberos == 0) 314 #endif 315 if (!authenticated && !hostok) 316 write(f, "rlogind: Host address mismatch.\r\n", 317 sizeof("rlogind: Host address mismatch.\r\n") - 1); 318 319 pid = fork(); 320 if (pid < 0) 321 fatal(f, "", 1); 322 if (pid == 0) { 323 if (setsid() < 0) 324 fatal(f, "setsid", 1); 325 if (ioctl(t, TIOCSCTTY, 0) < 0) 326 fatal(f, "ioctl(sctty)", 1); 327 (void)close(f); 328 (void)close(p); 329 dup2(t, STDIN_FILENO); 330 dup2(t, STDOUT_FILENO); 331 dup2(t, STDERR_FILENO); 332 (void)close(t); 333 334 if (authenticated) 335 execl(_PATH_LOGIN, "login", "-p", 336 "-h", hp->h_name, "-f", lusername, 0); 337 else 338 execl(_PATH_LOGIN, "login", "-p", 339 "-h", hp->h_name, lusername, 0); 340 fatal(STDERR_FILENO, _PATH_LOGIN, 1); 341 /*NOTREACHED*/ 342 } 343 close(t); 344 345 #ifdef KERBEROS 346 /* 347 * If encrypted, don't turn on NBIO or the des read/write 348 * routines will croak. 349 */ 350 351 if (!encrypt) 352 #endif 353 ioctl(f, FIONBIO, &on); 354 ioctl(p, FIONBIO, &on); 355 ioctl(p, TIOCPKT, &on); 356 signal(SIGCHLD, cleanup); 357 protocol(f, p); 358 signal(SIGCHLD, SIG_IGN); 359 cleanup(); 360 } 361 362 char magic[2] = { 0377, 0377 }; 363 char oobdata[] = {TIOCPKT_WINDOW}; 364 365 /* 366 * Handle a "control" request (signaled by magic being present) 367 * in the data stream. For now, we are only willing to handle 368 * window size changes. 369 */ 370 control(pty, cp, n) 371 int pty; 372 char *cp; 373 int n; 374 { 375 struct winsize w; 376 377 if (n < 4+sizeof (w) || cp[2] != 's' || cp[3] != 's') 378 return (0); 379 oobdata[0] &= ~TIOCPKT_WINDOW; /* we know he heard */ 380 bcopy(cp+4, (char *)&w, sizeof(w)); 381 w.ws_row = ntohs(w.ws_row); 382 w.ws_col = ntohs(w.ws_col); 383 w.ws_xpixel = ntohs(w.ws_xpixel); 384 w.ws_ypixel = ntohs(w.ws_ypixel); 385 (void)ioctl(pty, TIOCSWINSZ, &w); 386 return (4+sizeof (w)); 387 } 388 389 /* 390 * rlogin "protocol" machine. 391 */ 392 protocol(f, p) 393 register int f, p; 394 { 395 char pibuf[1024+1], fibuf[1024], *pbp, *fbp; 396 register pcc = 0, fcc = 0; 397 int cc, nfd, n; 398 char cntl; 399 400 /* 401 * Must ignore SIGTTOU, otherwise we'll stop 402 * when we try and set slave pty's window shape 403 * (our controlling tty is the master pty). 404 */ 405 (void) signal(SIGTTOU, SIG_IGN); 406 send(f, oobdata, 1, MSG_OOB); /* indicate new rlogin */ 407 if (f > p) 408 nfd = f + 1; 409 else 410 nfd = p + 1; 411 if (nfd > FD_SETSIZE) { 412 syslog(LOG_ERR, "select mask too small, increase FD_SETSIZE"); 413 fatal(f, "internal error (select mask too small)", 0); 414 } 415 for (;;) { 416 fd_set ibits, obits, ebits, *omask; 417 418 FD_ZERO(&ibits); 419 FD_ZERO(&obits); 420 omask = (fd_set *)NULL; 421 if (fcc) { 422 FD_SET(p, &obits); 423 omask = &obits; 424 } else 425 FD_SET(f, &ibits); 426 if (pcc >= 0) 427 if (pcc) { 428 FD_SET(f, &obits); 429 omask = &obits; 430 } else 431 FD_SET(p, &ibits); 432 FD_SET(p, &ebits); 433 if ((n = select(nfd, &ibits, omask, &ebits, 0)) < 0) { 434 if (errno == EINTR) 435 continue; 436 fatal(f, "select", 1); 437 } 438 if (n == 0) { 439 /* shouldn't happen... */ 440 sleep(5); 441 continue; 442 } 443 #define pkcontrol(c) ((c)&(TIOCPKT_FLUSHWRITE|TIOCPKT_NOSTOP|TIOCPKT_DOSTOP)) 444 if (FD_ISSET(p, &ebits)) { 445 cc = read(p, &cntl, 1); 446 if (cc == 1 && pkcontrol(cntl)) { 447 cntl |= oobdata[0]; 448 send(f, &cntl, 1, MSG_OOB); 449 if (cntl & TIOCPKT_FLUSHWRITE) { 450 pcc = 0; 451 FD_CLR(p, &ibits); 452 } 453 } 454 } 455 if (FD_ISSET(f, &ibits)) { 456 #ifdef KERBEROS 457 if (encrypt) 458 fcc = des_read(f, fibuf, sizeof(fibuf)); 459 else 460 #endif 461 fcc = read(f, fibuf, sizeof(fibuf)); 462 if (fcc < 0 && errno == EWOULDBLOCK) 463 fcc = 0; 464 else { 465 register char *cp; 466 int left, n; 467 468 if (fcc <= 0) 469 break; 470 fbp = fibuf; 471 472 top: 473 for (cp = fibuf; cp < fibuf+fcc-1; cp++) 474 if (cp[0] == magic[0] && 475 cp[1] == magic[1]) { 476 left = fcc - (cp-fibuf); 477 n = control(p, cp, left); 478 if (n) { 479 left -= n; 480 if (left > 0) 481 bcopy(cp+n, cp, left); 482 fcc -= n; 483 goto top; /* n^2 */ 484 } 485 } 486 FD_SET(p, &obits); /* try write */ 487 } 488 } 489 490 if (FD_ISSET(p, &obits) && fcc > 0) { 491 cc = write(p, fbp, fcc); 492 if (cc > 0) { 493 fcc -= cc; 494 fbp += cc; 495 } 496 } 497 498 if (FD_ISSET(p, &ibits)) { 499 pcc = read(p, pibuf, sizeof (pibuf)); 500 pbp = pibuf; 501 if (pcc < 0 && errno == EWOULDBLOCK) 502 pcc = 0; 503 else if (pcc <= 0) 504 break; 505 else if (pibuf[0] == 0) { 506 pbp++, pcc--; 507 #ifdef KERBEROS 508 if (!encrypt) 509 #endif 510 FD_SET(f, &obits); /* try write */ 511 } else { 512 if (pkcontrol(pibuf[0])) { 513 pibuf[0] |= oobdata[0]; 514 send(f, &pibuf[0], 1, MSG_OOB); 515 } 516 pcc = 0; 517 } 518 } 519 if ((FD_ISSET(f, &obits)) && pcc > 0) { 520 #ifdef KERBEROS 521 if (encrypt) 522 cc = des_write(f, pbp, pcc); 523 else 524 #endif 525 cc = write(f, pbp, pcc); 526 if (cc < 0 && errno == EWOULDBLOCK) { 527 /* 528 * This happens when we try write after read 529 * from p, but some old kernels balk at large 530 * writes even when select returns true. 531 */ 532 if (!FD_ISSET(p, &ibits)) 533 sleep(5); 534 continue; 535 } 536 if (cc > 0) { 537 pcc -= cc; 538 pbp += cc; 539 } 540 } 541 } 542 } 543 544 cleanup() 545 { 546 char *p; 547 548 p = line + sizeof(_PATH_DEV) - 1; 549 if (logout(p)) 550 logwtmp(p, "", ""); 551 (void)chmod(line, 0666); 552 (void)chown(line, 0, 0); 553 *p = 'p'; 554 (void)chmod(line, 0666); 555 (void)chown(line, 0, 0); 556 shutdown(netf, 2); 557 exit(1); 558 } 559 560 fatal(f, msg, syserr) 561 int f, syserr; 562 char *msg; 563 { 564 int len; 565 char buf[BUFSIZ], *bp = buf; 566 567 /* 568 * Prepend binary one to message if we haven't sent 569 * the magic null as confirmation. 570 */ 571 if (!confirmed) 572 *bp++ = '\01'; /* error indicator */ 573 if (syserr) 574 len = sprintf(bp, "rlogind: %s: %s.\r\n", 575 msg, strerror(errno)); 576 else 577 len = sprintf(bp, "rlogind: %s.\r\n", msg); 578 (void) write(f, buf, bp + len - buf); 579 exit(1); 580 } 581 582 do_rlogin(host) 583 char *host; 584 { 585 getstr(rusername, sizeof(rusername), "remuser too long"); 586 getstr(lusername, sizeof(lusername), "locuser too long"); 587 getstr(term+ENVSIZE, sizeof(term)-ENVSIZE, "Terminal type too long"); 588 589 pwd = getpwnam(lusername); 590 if (pwd == NULL) 591 return(-1); 592 if (pwd->pw_uid == 0) 593 return(-1); 594 return(ruserok(host, 0, rusername, lusername)); 595 } 596 597 598 getstr(buf, cnt, errmsg) 599 char *buf; 600 int cnt; 601 char *errmsg; 602 { 603 char c; 604 605 do { 606 if (read(0, &c, 1) != 1) 607 exit(1); 608 if (--cnt < 0) 609 fatal(STDOUT_FILENO, errmsg, 0); 610 *buf++ = c; 611 } while (c != 0); 612 } 613 614 extern char **environ; 615 616 setup_term(fd) 617 int fd; 618 { 619 register char *cp = index(term+ENVSIZE, '/'); 620 char *speed; 621 struct termios tt; 622 623 #ifndef notyet 624 tcgetattr(fd, &tt); 625 if (cp) { 626 *cp++ = '\0'; 627 speed = cp; 628 cp = index(speed, '/'); 629 if (cp) 630 *cp++ = '\0'; 631 cfsetspeed(&tt, atoi(speed)); 632 } 633 634 tt.c_iflag = TTYDEF_IFLAG; 635 tt.c_oflag = TTYDEF_OFLAG; 636 tt.c_lflag = TTYDEF_LFLAG; 637 tcsetattr(fd, TCSADFLUSH, &tt); 638 #else 639 if (cp) { 640 *cp++ = '\0'; 641 speed = cp; 642 cp = index(speed, '/'); 643 if (cp) 644 *cp++ = '\0'; 645 tcgetattr(fd, &tt); 646 cfsetspeed(&tt, atoi(speed)); 647 tcsetattr(fd, TCSADFLUSH, &tt); 648 } 649 #endif 650 651 env[0] = term; 652 env[1] = 0; 653 environ = env; 654 } 655 656 #ifdef KERBEROS 657 #define VERSION_SIZE 9 658 659 /* 660 * Do the remote kerberos login to the named host with the 661 * given inet address 662 * 663 * Return 0 on valid authorization 664 * Return -1 on valid authentication, no authorization 665 * Return >0 for error conditions 666 */ 667 do_krb_login(host, dest, encrypt) 668 char *host; 669 struct sockaddr_in *dest; 670 int encrypt; 671 { 672 int rc; 673 char instance[INST_SZ], version[VERSION_SIZE]; 674 long authopts = 0L; /* !mutual */ 675 struct sockaddr_in faddr; 676 677 kdata = (AUTH_DAT *) auth_buf; 678 ticket = (KTEXT) tick_buf; 679 680 instance[0] = '*'; 681 instance[1] = '\0'; 682 683 if (encrypt) { 684 rc = sizeof(faddr); 685 if (getsockname(0, &faddr, &rc)) 686 return(-1); 687 authopts = KOPT_DO_MUTUAL; 688 rc = krb_recvauth( 689 authopts, 0, 690 ticket, "rcmd", 691 instance, dest, &faddr, 692 kdata, "", schedule, version); 693 des_set_key(kdata->session, schedule); 694 695 } else { 696 rc = krb_recvauth( 697 authopts, 0, 698 ticket, "rcmd", 699 instance, dest, (struct sockaddr_in *) 0, 700 kdata, "", (bit_64 *) 0, version); 701 } 702 703 if (rc != KSUCCESS) 704 return(rc); 705 706 getstr(lusername, sizeof(lusername), "locuser"); 707 /* get the "cmd" in the rcmd protocol */ 708 getstr(term+ENVSIZE, sizeof(term)-ENVSIZE, "Terminal type"); 709 710 pwd = getpwnam(lusername); 711 if (pwd == NULL) 712 return(-1); 713 714 /* returns nonzero for no access */ 715 if (kuserok(kdata,lusername) != 0) 716 return(-1); 717 718 return(0); 719 720 } 721 #endif /* KERBEROS */ 722 723 usage() 724 { 725 #ifdef KERBEROS 726 syslog(LOG_ERR, "usage: rlogind [-aln] [-k | -v]"); 727 #else 728 syslog(LOG_ERR, "usage: rlogind [-aln]"); 729 #endif 730 } 731 732 /* 733 * Check whether host h is in our local domain, 734 * defined as sharing the last two components of the domain part, 735 * or the entire domain part if the local domain has only one component. 736 * If either name is unqualified (contains no '.'), 737 * assume that the host is local, as it will be 738 * interpreted as such. 739 */ 740 local_domain(h) 741 char *h; 742 { 743 char localhost[MAXHOSTNAMELEN]; 744 char *p1, *p2, *topdomain(); 745 746 localhost[0] = 0; 747 (void) gethostname(localhost, sizeof(localhost)); 748 p1 = topdomain(localhost); 749 p2 = topdomain(h); 750 if (p1 == NULL || p2 == NULL || !strcasecmp(p1, p2)) 751 return(1); 752 return(0); 753 } 754 755 char * 756 topdomain(h) 757 char *h; 758 { 759 register char *p; 760 char *maybe = NULL; 761 int dots = 0; 762 763 for (p = h + strlen(h); p >= h; p--) { 764 if (*p == '.') { 765 if (++dots == 2) 766 return (p); 767 maybe = p; 768 } 769 } 770 return (maybe); 771 } 772