blob: a835abfc6c3366241e9b94fa29ada5abd22e34b5 [file] [log] [blame]
Damien Miller0b4d48b2008-07-05 09:44:53 +10001/* $OpenBSD: auth2.c,v 1.119 2008/07/04 23:30:16 djm Exp $ */
Damien Millereba71ba2000-04-29 23:57:08 +10002/*
3 * Copyright (c) 2000 Markus Friedl. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
Damien Millereba71ba2000-04-29 23:57:08 +100013 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
Damien Millere4340be2000-09-16 13:29:08 +110025
Damien Millereba71ba2000-04-29 23:57:08 +100026#include "includes.h"
Damien Millereba71ba2000-04-29 23:57:08 +100027
Damien Miller9f2abc42006-07-10 20:53:08 +100028#include <sys/types.h>
Darren Tucker4230a5d2008-07-02 22:56:09 +100029#include <sys/stat.h>
30#include <sys/uio.h>
Damien Miller9f2abc42006-07-10 20:53:08 +100031
Darren Tucker4230a5d2008-07-02 22:56:09 +100032#include <fcntl.h>
Damien Miller9f2abc42006-07-10 20:53:08 +100033#include <pwd.h>
Damien Millerd7834352006-08-05 12:39:39 +100034#include <stdarg.h>
Damien Millere3476ed2006-07-24 14:13:33 +100035#include <string.h>
Darren Tucker4230a5d2008-07-02 22:56:09 +100036#include <unistd.h>
Damien Miller9f2abc42006-07-10 20:53:08 +100037
Damien Millereba71ba2000-04-29 23:57:08 +100038#include "xmalloc.h"
Damien Miller0b4d48b2008-07-05 09:44:53 +100039#include "atomicio.h"
Damien Millerd7834352006-08-05 12:39:39 +100040#include "ssh2.h"
Damien Millereba71ba2000-04-29 23:57:08 +100041#include "packet.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000042#include "log.h"
Damien Millerd7834352006-08-05 12:39:39 +100043#include "buffer.h"
Damien Millereba71ba2000-04-29 23:57:08 +100044#include "servconf.h"
45#include "compat.h"
Damien Millerd7834352006-08-05 12:39:39 +100046#include "key.h"
47#include "hostfile.h"
Damien Millereba71ba2000-04-29 23:57:08 +100048#include "auth.h"
Damien Millereba71ba2000-04-29 23:57:08 +100049#include "dispatch.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000050#include "pathnames.h"
Darren Tucker77fc29e2004-09-11 23:07:03 +100051#include "buffer.h"
Damien Millereba71ba2000-04-29 23:57:08 +100052
Darren Tucker0efd1552003-08-26 11:49:55 +100053#ifdef GSSAPI
54#include "ssh-gss.h"
55#endif
Damien Millerd7834352006-08-05 12:39:39 +100056#include "monitor_wrap.h"
Darren Tucker0efd1552003-08-26 11:49:55 +100057
Damien Millereba71ba2000-04-29 23:57:08 +100058/* import */
59extern ServerOptions options;
Ben Lindstrom46c16222000-12-22 01:43:59 +000060extern u_char *session_id2;
Darren Tucker502d3842003-06-28 12:38:01 +100061extern u_int session_id2_len;
Darren Tucker77fc29e2004-09-11 23:07:03 +100062extern Buffer loginmsg;
Damien Millereba71ba2000-04-29 23:57:08 +100063
Ben Lindstrom511bb242002-06-06 20:52:37 +000064/* methods */
65
66extern Authmethod method_none;
67extern Authmethod method_pubkey;
68extern Authmethod method_passwd;
69extern Authmethod method_kbdint;
70extern Authmethod method_hostbased;
Darren Tucker0efd1552003-08-26 11:49:55 +100071#ifdef GSSAPI
72extern Authmethod method_gssapi;
73#endif
Ben Lindstrom511bb242002-06-06 20:52:37 +000074
75Authmethod *authmethods[] = {
76 &method_none,
77 &method_pubkey,
Darren Tucker0efd1552003-08-26 11:49:55 +100078#ifdef GSSAPI
79 &method_gssapi,
80#endif
Ben Lindstrom511bb242002-06-06 20:52:37 +000081 &method_passwd,
82 &method_kbdint,
83 &method_hostbased,
84 NULL
Damien Miller874d77b2000-10-14 16:23:11 +110085};
86
Damien Millereba71ba2000-04-29 23:57:08 +100087/* protocol */
88
Damien Miller630d6f42002-01-22 23:17:30 +110089static void input_service_request(int, u_int32_t, void *);
90static void input_userauth_request(int, u_int32_t, void *);
Damien Millereba71ba2000-04-29 23:57:08 +100091
Damien Millereba71ba2000-04-29 23:57:08 +100092/* helper */
Ben Lindstrombba81212001-06-25 05:01:22 +000093static Authmethod *authmethod_lookup(const char *);
Ben Lindstrom79073822001-07-04 03:42:30 +000094static char *authmethods_get(void);
Damien Millereba71ba2000-04-29 23:57:08 +100095
Darren Tucker4230a5d2008-07-02 22:56:09 +100096char *
97auth2_read_banner(void)
98{
99 struct stat st;
100 char *banner = NULL;
101 size_t len, n;
102 int fd;
103
104 if ((fd = open(options.banner, O_RDONLY)) == -1)
105 return (NULL);
106 if (fstat(fd, &st) == -1) {
107 close(fd);
108 return (NULL);
109 }
110 if (st.st_size > 1*1024*1024) {
111 close(fd);
112 return (NULL);
113 }
114
115 len = (size_t)st.st_size; /* truncate */
116 banner = xmalloc(len + 1);
117 n = atomicio(read, fd, banner, len);
118 close(fd);
119
120 if (n != len) {
121 xfree(banner);
122 return (NULL);
123 }
124 banner[n] = '\0';
125
126 return (banner);
127}
128
129void
130userauth_send_banner(const char *msg)
131{
132 if (datafellows & SSH_BUG_BANNER)
133 return;
134
135 packet_start(SSH2_MSG_USERAUTH_BANNER);
136 packet_put_cstring(msg);
137 packet_put_cstring(""); /* language, unused */
138 packet_send();
139 debug("%s: sent", __func__);
140}
141
142static void
143userauth_banner(void)
144{
145 char *banner = NULL;
146
147 if (options.banner == NULL ||
148 strcasecmp(options.banner, "none") == 0 ||
149 (datafellows & SSH_BUG_BANNER) != 0)
150 return;
151
152 if ((banner = PRIVSEP(auth2_read_banner())) == NULL)
153 goto done;
154 userauth_send_banner(banner);
155
156done:
157 if (banner)
158 xfree(banner);
159}
160
Damien Millereba71ba2000-04-29 23:57:08 +1000161/*
Damien Miller874d77b2000-10-14 16:23:11 +1100162 * loop until authctxt->success == TRUE
Damien Millereba71ba2000-04-29 23:57:08 +1000163 */
Darren Tucker3e33cec2003-10-02 16:12:36 +1000164void
165do_authentication2(Authctxt *authctxt)
Damien Millereba71ba2000-04-29 23:57:08 +1000166{
Damien Miller7d053392002-01-22 23:24:13 +1100167 dispatch_init(&dispatch_protocol_error);
Damien Millereba71ba2000-04-29 23:57:08 +1000168 dispatch_set(SSH2_MSG_SERVICE_REQUEST, &input_service_request);
Damien Miller874d77b2000-10-14 16:23:11 +1100169 dispatch_run(DISPATCH_BLOCK, &authctxt->success, authctxt);
Damien Millereba71ba2000-04-29 23:57:08 +1000170}
171
Damien Miller91d4b122006-03-26 14:05:20 +1100172/*ARGSUSED*/
Ben Lindstrombba81212001-06-25 05:01:22 +0000173static void
Damien Miller630d6f42002-01-22 23:17:30 +1100174input_service_request(int type, u_int32_t seq, void *ctxt)
Damien Millereba71ba2000-04-29 23:57:08 +1000175{
Damien Miller874d77b2000-10-14 16:23:11 +1100176 Authctxt *authctxt = ctxt;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000177 u_int len;
Ben Lindstrom5a9d0ea2002-07-04 00:12:53 +0000178 int acceptit = 0;
Damien Millereba71ba2000-04-29 23:57:08 +1000179 char *service = packet_get_string(&len);
Damien Miller48b03fc2002-01-22 23:11:40 +1100180 packet_check_eom();
Damien Millereba71ba2000-04-29 23:57:08 +1000181
Damien Miller874d77b2000-10-14 16:23:11 +1100182 if (authctxt == NULL)
183 fatal("input_service_request: no authctxt");
184
Damien Millereba71ba2000-04-29 23:57:08 +1000185 if (strcmp(service, "ssh-userauth") == 0) {
Damien Miller874d77b2000-10-14 16:23:11 +1100186 if (!authctxt->success) {
Ben Lindstrom5a9d0ea2002-07-04 00:12:53 +0000187 acceptit = 1;
Damien Millereba71ba2000-04-29 23:57:08 +1000188 /* now we can handle user-auth requests */
189 dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &input_userauth_request);
190 }
191 }
192 /* XXX all other service requests are denied */
193
Ben Lindstrom5a9d0ea2002-07-04 00:12:53 +0000194 if (acceptit) {
Damien Millereba71ba2000-04-29 23:57:08 +1000195 packet_start(SSH2_MSG_SERVICE_ACCEPT);
196 packet_put_cstring(service);
197 packet_send();
198 packet_write_wait();
199 } else {
200 debug("bad service request %s", service);
201 packet_disconnect("bad service request %s", service);
202 }
203 xfree(service);
204}
205
Damien Miller91d4b122006-03-26 14:05:20 +1100206/*ARGSUSED*/
Ben Lindstrombba81212001-06-25 05:01:22 +0000207static void
Damien Miller630d6f42002-01-22 23:17:30 +1100208input_userauth_request(int type, u_int32_t seq, void *ctxt)
Damien Millereba71ba2000-04-29 23:57:08 +1000209{
Damien Miller874d77b2000-10-14 16:23:11 +1100210 Authctxt *authctxt = ctxt;
211 Authmethod *m = NULL;
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000212 char *user, *service, *method, *style = NULL;
Damien Millereba71ba2000-04-29 23:57:08 +1000213 int authenticated = 0;
Damien Millereba71ba2000-04-29 23:57:08 +1000214
Damien Miller874d77b2000-10-14 16:23:11 +1100215 if (authctxt == NULL)
216 fatal("input_userauth_request: no authctxt");
Damien Millereba71ba2000-04-29 23:57:08 +1000217
Damien Miller874d77b2000-10-14 16:23:11 +1100218 user = packet_get_string(NULL);
219 service = packet_get_string(NULL);
220 method = packet_get_string(NULL);
221 debug("userauth-request for user %s service %s method %s", user, service, method);
Ben Lindstrom4dccfa52000-12-28 16:40:05 +0000222 debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
Damien Miller874d77b2000-10-14 16:23:11 +1100223
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000224 if ((style = strchr(user, ':')) != NULL)
225 *style++ = 0;
226
Kevin Stevesef4eea92001-02-05 12:42:17 +0000227 if (authctxt->attempt++ == 0) {
Damien Miller3a5b0232002-03-13 13:19:42 +1100228 /* setup auth context */
Kevin Steves205cc1e2002-03-22 20:43:05 +0000229 authctxt->pw = PRIVSEP(getpwnamallow(user));
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100230 authctxt->user = xstrdup(user);
Kevin Steves205cc1e2002-03-22 20:43:05 +0000231 if (authctxt->pw && strcmp(service, "ssh-connection")==0) {
Damien Miller874d77b2000-10-14 16:23:11 +1100232 authctxt->valid = 1;
233 debug2("input_userauth_request: setting up authctxt for %s", user);
Damien Miller874d77b2000-10-14 16:23:11 +1100234 } else {
Darren Tucker5cb30ad2004-08-12 22:40:24 +1000235 logit("input_userauth_request: invalid user %s", user);
Damien Miller856f0be2003-09-03 07:32:45 +1000236 authctxt->pw = fakepw();
Darren Tucker2e0cf0d2005-02-08 21:52:47 +1100237#ifdef SSH_AUDIT_EVENTS
238 PRIVSEP(audit_event(SSH_INVALID_USER));
Darren Tucker269a1ea2005-02-03 00:20:53 +1100239#endif
Damien Miller874d77b2000-10-14 16:23:11 +1100240 }
Darren Tuckerd3eff2b2005-09-24 12:43:51 +1000241#ifdef USE_PAM
242 if (options.use_pam)
243 PRIVSEP(start_pam(authctxt));
244#endif
Damien Miller30d1f842004-07-21 20:48:53 +1000245 setproctitle("%s%s", authctxt->valid ? user : "unknown",
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000246 use_privsep ? " [net]" : "");
Damien Miller874d77b2000-10-14 16:23:11 +1100247 authctxt->service = xstrdup(service);
Ben Lindstrom9d0c0662001-06-09 01:40:00 +0000248 authctxt->style = style ? xstrdup(style) : NULL;
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000249 if (use_privsep)
250 mm_inform_authserv(service, style);
Darren Tucker4230a5d2008-07-02 22:56:09 +1000251 userauth_banner();
Ben Lindstrom9d0c0662001-06-09 01:40:00 +0000252 } else if (strcmp(user, authctxt->user) != 0 ||
253 strcmp(service, authctxt->service) != 0) {
254 packet_disconnect("Change of username or service not allowed: "
255 "(%s,%s) -> (%s,%s)",
256 authctxt->user, authctxt->service, user, service);
Damien Millereba71ba2000-04-29 23:57:08 +1000257 }
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000258 /* reset state */
Damien Milleree116252001-12-21 12:42:34 +1100259 auth2_challenge_stop(authctxt);
Darren Tucker0efd1552003-08-26 11:49:55 +1000260
261#ifdef GSSAPI
262 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
263 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
264#endif
265
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000266 authctxt->postponed = 0;
Damien Millerb70b61f2000-09-16 16:25:12 +1100267
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000268 /* try to authenticate user */
Damien Miller874d77b2000-10-14 16:23:11 +1100269 m = authmethod_lookup(method);
Darren Tucker4230a5d2008-07-02 22:56:09 +1000270 if (m != NULL && authctxt->failures < options.max_authtries) {
Damien Miller874d77b2000-10-14 16:23:11 +1100271 debug2("input_userauth_request: try method %s", method);
272 authenticated = m->userauth(authctxt);
Damien Miller874d77b2000-10-14 16:23:11 +1100273 }
Damien Miller5d57e502001-03-30 10:48:31 +1000274 userauth_finish(authctxt, authenticated, method);
275
276 xfree(service);
277 xfree(user);
278 xfree(method);
279}
280
281void
282userauth_finish(Authctxt *authctxt, int authenticated, char *method)
283{
Ben Lindstromcd4349f2001-06-09 00:23:17 +0000284 char *methods;
285
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000286 if (!authctxt->valid && authenticated)
287 fatal("INTERNAL ERROR: authenticated invalid user %s",
288 authctxt->user);
Damien Millerb70b61f2000-09-16 16:25:12 +1100289
Damien Miller874d77b2000-10-14 16:23:11 +1100290 /* Special handling for root */
Damien Miller556f9312003-02-24 11:59:26 +1100291 if (authenticated && authctxt->pw->pw_uid == 0 &&
Darren Tucker269a1ea2005-02-03 00:20:53 +1100292 !auth_root_allowed(method)) {
Damien Millereba71ba2000-04-29 23:57:08 +1000293 authenticated = 0;
Darren Tucker2e0cf0d2005-02-08 21:52:47 +1100294#ifdef SSH_AUDIT_EVENTS
295 PRIVSEP(audit_event(SSH_LOGIN_ROOT_DENIED));
Darren Tucker269a1ea2005-02-03 00:20:53 +1100296#endif
297 }
Damien Millereba71ba2000-04-29 23:57:08 +1000298
Damien Miller1f499fd2003-08-25 13:08:49 +1000299#ifdef USE_PAM
Darren Tucker77fc29e2004-09-11 23:07:03 +1000300 if (options.use_pam && authenticated) {
301 if (!PRIVSEP(do_pam_account())) {
Darren Tucker77fc29e2004-09-11 23:07:03 +1000302 /* if PAM returned a message, send it to the user */
303 if (buffer_len(&loginmsg) > 0) {
304 buffer_append(&loginmsg, "\0", 1);
305 userauth_send_banner(buffer_ptr(&loginmsg));
Darren Tuckerc1386672004-12-03 14:33:47 +1100306 packet_write_wait();
Darren Tucker77fc29e2004-09-11 23:07:03 +1000307 }
Darren Tuckerc1386672004-12-03 14:33:47 +1100308 fatal("Access denied for user %s by PAM account "
Damien Millerb6f72f52005-07-17 17:26:43 +1000309 "configuration", authctxt->user);
Darren Tucker77fc29e2004-09-11 23:07:03 +1000310 }
311 }
Damien Miller1f499fd2003-08-25 13:08:49 +1000312#endif
313
Tim Rice81ed5182002-09-25 17:38:46 -0700314#ifdef _UNICOS
315 if (authenticated && cray_access_denied(authctxt->user)) {
316 authenticated = 0;
317 fatal("Access denied for user %s.",authctxt->user);
318 }
319#endif /* _UNICOS */
320
Damien Miller874d77b2000-10-14 16:23:11 +1100321 /* Log before sending the reply */
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000322 auth_log(authctxt, authenticated, method, " ssh2");
323
Ben Lindstromcd4349f2001-06-09 00:23:17 +0000324 if (authctxt->postponed)
325 return;
326
327 /* XXX todo: check if multiple auth methods are needed */
328 if (authenticated == 1) {
329 /* turn off userauth */
Damien Miller7d053392002-01-22 23:24:13 +1100330 dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &dispatch_protocol_ignore);
Ben Lindstromcd4349f2001-06-09 00:23:17 +0000331 packet_start(SSH2_MSG_USERAUTH_SUCCESS);
332 packet_send();
333 packet_write_wait();
334 /* now we can break out */
335 authctxt->success = 1;
336 } else {
Damien Miller0b4d48b2008-07-05 09:44:53 +1000337
338 /* Allow initial try of "none" auth without failure penalty */
339 if (authctxt->attempt > 1 || strcmp(method, "none") != 0)
340 authctxt->failures++;
341 if (authctxt->failures >= options.max_authtries) {
Darren Tucker2e0cf0d2005-02-08 21:52:47 +1100342#ifdef SSH_AUDIT_EVENTS
343 PRIVSEP(audit_event(SSH_LOGIN_EXCEED_MAXTRIES));
Darren Tucker269a1ea2005-02-03 00:20:53 +1100344#endif
Ben Lindstromcd4349f2001-06-09 00:23:17 +0000345 packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
Darren Tucker269a1ea2005-02-03 00:20:53 +1100346 }
Ben Lindstromcd4349f2001-06-09 00:23:17 +0000347 methods = authmethods_get();
348 packet_start(SSH2_MSG_USERAUTH_FAILURE);
349 packet_put_cstring(methods);
350 packet_put_char(0); /* XXX partial success, unused */
351 packet_send();
352 packet_write_wait();
353 xfree(methods);
354 }
Damien Miller874d77b2000-10-14 16:23:11 +1100355}
356
Ben Lindstrom79073822001-07-04 03:42:30 +0000357static char *
Damien Miller874d77b2000-10-14 16:23:11 +1100358authmethods_get(void)
359{
Damien Miller0e3b8722002-01-22 23:26:38 +1100360 Buffer b;
Damien Miller874d77b2000-10-14 16:23:11 +1100361 char *list;
Ben Lindstrom511bb242002-06-06 20:52:37 +0000362 int i;
Damien Miller874d77b2000-10-14 16:23:11 +1100363
Damien Miller0e3b8722002-01-22 23:26:38 +1100364 buffer_init(&b);
Ben Lindstrom511bb242002-06-06 20:52:37 +0000365 for (i = 0; authmethods[i] != NULL; i++) {
366 if (strcmp(authmethods[i]->name, "none") == 0)
Damien Miller874d77b2000-10-14 16:23:11 +1100367 continue;
Ben Lindstrom511bb242002-06-06 20:52:37 +0000368 if (authmethods[i]->enabled != NULL &&
369 *(authmethods[i]->enabled) != 0) {
Damien Miller0e3b8722002-01-22 23:26:38 +1100370 if (buffer_len(&b) > 0)
371 buffer_append(&b, ",", 1);
Ben Lindstrom511bb242002-06-06 20:52:37 +0000372 buffer_append(&b, authmethods[i]->name,
373 strlen(authmethods[i]->name));
Damien Millereba71ba2000-04-29 23:57:08 +1000374 }
375 }
Damien Miller0e3b8722002-01-22 23:26:38 +1100376 buffer_append(&b, "\0", 1);
377 list = xstrdup(buffer_ptr(&b));
378 buffer_free(&b);
Damien Miller874d77b2000-10-14 16:23:11 +1100379 return list;
380}
381
Ben Lindstrombba81212001-06-25 05:01:22 +0000382static Authmethod *
Damien Miller874d77b2000-10-14 16:23:11 +1100383authmethod_lookup(const char *name)
384{
Ben Lindstrom511bb242002-06-06 20:52:37 +0000385 int i;
386
Damien Miller874d77b2000-10-14 16:23:11 +1100387 if (name != NULL)
Ben Lindstrom511bb242002-06-06 20:52:37 +0000388 for (i = 0; authmethods[i] != NULL; i++)
389 if (authmethods[i]->enabled != NULL &&
390 *(authmethods[i]->enabled) != 0 &&
391 strcmp(name, authmethods[i]->name) == 0)
392 return authmethods[i];
393 debug2("Unrecognized authentication method name: %s",
394 name ? name : "NULL");
Damien Miller874d77b2000-10-14 16:23:11 +1100395 return NULL;
Damien Millereba71ba2000-04-29 23:57:08 +1000396}
Darren Tucker4230a5d2008-07-02 22:56:09 +1000397