1 /* 2 * Copyright (c) 1983, 1988, 1989 The Regents of the University of California. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms are permitted 6 * provided that the above copyright notice and this paragraph are 7 * duplicated in all such forms and that any documentation, 8 * advertising materials, and other materials related to such 9 * distribution and use acknowledge that the software was developed 10 * by the University of California, Berkeley. The name of the 11 * University may not be used to endorse or promote products derived 12 * from this software without specific prior written permission. 13 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 14 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 15 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 16 */ 17 18 #ifndef lint 19 char copyright[] = 20 "@(#) Copyright (c) 1983, 1988, 1989 The Regents of the University of California.\n\ 21 All rights reserved.\n"; 22 #endif /* not lint */ 23 24 #ifndef lint 25 static char sccsid[] = "@(#)rlogind.c 5.44 (Berkeley) 06/07/90"; 26 #endif /* not lint */ 27 28 #ifdef KERBEROS 29 /* From: 30 * $Source: /mit/kerberos/ucb/mit/rlogind/RCS/rlogind.c,v $ 31 * $Header: rlogind.c,v 5.0 89/06/26 18:31:01 kfall Locked $ 32 */ 33 #endif 34 35 /* 36 * remote login server: 37 * \0 38 * remuser\0 39 * locuser\0 40 * terminal_type/speed\0 41 * data 42 */ 43 44 #define FD_SETSIZE 16 /* don't need many bits for select */ 45 #include <sys/param.h> 46 #include <sys/stat.h> 47 #include <sys/socket.h> 48 #include <sys/wait.h> 49 #include <sys/file.h> 50 #include <sys/signal.h> 51 #include <sys/ioctl.h> 52 #include <sys/termios.h> 53 54 #include <netinet/in.h> 55 56 #include <errno.h> 57 #include <pwd.h> 58 #include <netdb.h> 59 #include <syslog.h> 60 #include <string.h> 61 #include <stdio.h> 62 #include <unistd.h> 63 #include "pathnames.h" 64 65 #ifndef TIOCPKT_WINDOW 66 #define TIOCPKT_WINDOW 0x80 67 #endif 68 69 #ifdef KERBEROS 70 #include <kerberosIV/des.h> 71 #include <kerberosIV/krb.h> 72 #define SECURE_MESSAGE "This rlogin session is using DES encryption for all transmissions.\r\n" 73 74 AUTH_DAT *kdata; 75 KTEXT ticket; 76 u_char auth_buf[sizeof(AUTH_DAT)]; 77 u_char tick_buf[sizeof(KTEXT_ST)]; 78 Key_schedule schedule; 79 int encrypt = 0, retval, use_kerberos = 0, vacuous = 0; 80 81 #define ARGSTR "alnkvx" 82 #else 83 #define ARGSTR "aln" 84 #endif /* KERBEROS */ 85 86 char *env[2]; 87 #define NMAX 30 88 char lusername[NMAX+1], rusername[NMAX+1]; 89 static char term[64] = "TERM="; 90 #define ENVSIZE (sizeof("TERM=")-1) /* skip null for concatenation */ 91 int keepalive = 1; 92 int check_all = 0; 93 94 extern int errno; 95 int reapchild(); 96 struct passwd *getpwnam(), *pwd; 97 char *malloc(); 98 99 main(argc, argv) 100 int argc; 101 char **argv; 102 { 103 extern int opterr, optind; 104 extern int _check_rhosts_file; 105 int ch; 106 int on = 1, fromlen; 107 struct sockaddr_in from; 108 109 openlog("rlogind", LOG_PID | LOG_CONS, LOG_AUTH); 110 111 opterr = 0; 112 while ((ch = getopt(argc, argv, ARGSTR)) != EOF) 113 switch (ch) { 114 case 'a': 115 check_all = 1; 116 break; 117 case 'l': 118 _check_rhosts_file = 0; 119 break; 120 case 'n': 121 keepalive = 0; 122 break; 123 #ifdef KERBEROS 124 case 'k': 125 use_kerberos = 1; 126 break; 127 case 'v': 128 vacuous = 1; 129 break; 130 case 'x': 131 encrypt = 1; 132 break; 133 #endif 134 case '?': 135 default: 136 usage(); 137 break; 138 } 139 argc -= optind; 140 argv += optind; 141 142 #ifdef KERBEROS 143 if (use_kerberos && vacuous) { 144 usage(); 145 fatal(STDERR_FILENO, "only one of -k and -v allowed", 0); 146 } 147 #endif 148 fromlen = sizeof (from); 149 if (getpeername(0, &from, &fromlen) < 0) { 150 syslog(LOG_ERR,"Can't get peer name of remote host: %m"); 151 fatal(STDERR_FILENO, "Can't get peer name of remote host", 1); 152 } 153 if (keepalive && 154 setsockopt(0, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof (on)) < 0) 155 syslog(LOG_WARNING, "setsockopt (SO_KEEPALIVE): %m"); 156 doit(0, &from); 157 } 158 159 int child; 160 int cleanup(); 161 int netf; 162 char *line; 163 int confirmed; 164 extern char *inet_ntoa(); 165 166 struct winsize win = { 0, 0, 0, 0 }; 167 168 169 doit(f, fromp) 170 int f; 171 struct sockaddr_in *fromp; 172 { 173 int i, p, t, pid, on = 1; 174 int authenticated = 0, hostok = 0; 175 register struct hostent *hp; 176 char remotehost[2 * MAXHOSTNAMELEN + 1]; 177 struct hostent hostent; 178 char c; 179 180 alarm(60); 181 read(f, &c, 1); 182 183 if (c != 0) 184 exit(1); 185 #ifdef KERBEROS 186 if (vacuous) 187 fatal(f, "Remote host requires Kerberos authentication", 0); 188 #endif 189 190 alarm(0); 191 fromp->sin_port = ntohs((u_short)fromp->sin_port); 192 hp = gethostbyaddr(&fromp->sin_addr, sizeof (struct in_addr), 193 fromp->sin_family); 194 if (hp == 0) { 195 /* 196 * Only the name is used below. 197 */ 198 hp = &hostent; 199 hp->h_name = inet_ntoa(fromp->sin_addr); 200 hostok++; 201 } else if (check_all || local_domain(hp->h_name)) { 202 /* 203 * If name returned by gethostbyaddr is in our domain, 204 * attempt to verify that we haven't been fooled by someone 205 * in a remote net; look up the name and check that this 206 * address corresponds to the name. 207 */ 208 strncpy(remotehost, hp->h_name, sizeof(remotehost) - 1); 209 remotehost[sizeof(remotehost) - 1] = 0; 210 hp = gethostbyname(remotehost); 211 if (hp) 212 for (; hp->h_addr_list[0]; hp->h_addr_list++) 213 if (!bcmp(hp->h_addr_list[0], (caddr_t)&fromp->sin_addr, 214 sizeof(fromp->sin_addr))) { 215 hostok++; 216 break; 217 } 218 } else 219 hostok++; 220 221 #ifdef KERBEROS 222 if (use_kerberos) { 223 if (!hostok) 224 fatal(f, "krlogind: Host address mismatch.", 0); 225 retval = do_krb_login(hp->h_name, fromp, encrypt); 226 if (retval == 0) 227 authenticated++; 228 else if (retval > 0) 229 fatal(f, krb_err_txt[retval], 0); 230 write(f, &c, 1); 231 confirmed = 1; /* we sent the null! */ 232 } else 233 #endif 234 { 235 if (fromp->sin_family != AF_INET || 236 fromp->sin_port >= IPPORT_RESERVED || 237 fromp->sin_port < IPPORT_RESERVED/2) { 238 syslog(LOG_NOTICE, "Connection from %s on illegal port", 239 inet_ntoa(fromp->sin_addr)); 240 fatal(f, "Permission denied", 0); 241 } 242 #ifdef IP_OPTIONS 243 { 244 u_char optbuf[BUFSIZ/3], *cp; 245 char lbuf[BUFSIZ], *lp; 246 int optsize = sizeof(optbuf), ipproto; 247 struct protoent *ip; 248 249 if ((ip = getprotobyname("ip")) != NULL) 250 ipproto = ip->p_proto; 251 else 252 ipproto = IPPROTO_IP; 253 if (getsockopt(0, ipproto, IP_OPTIONS, (char *)optbuf, 254 &optsize) == 0 && optsize != 0) { 255 lp = lbuf; 256 for (cp = optbuf; optsize > 0; cp++, optsize--, lp += 3) 257 sprintf(lp, " %2.2x", *cp); 258 syslog(LOG_NOTICE, 259 "Connection received using IP options (ignored):%s", 260 lbuf); 261 if (setsockopt(0, ipproto, IP_OPTIONS, 262 (char *)NULL, &optsize) != 0) { 263 syslog(LOG_ERR, "setsockopt IP_OPTIONS NULL: %m"); 264 exit(1); 265 } 266 } 267 } 268 #endif 269 if (do_rlogin(hp->h_name) == 0 && hostok) 270 authenticated++; 271 } 272 273 for (c = 'p'; c <= 's'; c++) { 274 struct stat stb; 275 line = "/dev/ptyXX"; 276 line[strlen("/dev/pty")] = c; 277 line[strlen("/dev/ptyp")] = '0'; 278 if (stat(line, &stb) < 0) 279 break; 280 for (i = 0; i < 16; i++) { 281 line[sizeof("/dev/ptyp") - 1] = "0123456789abcdef"[i]; 282 p = open(line, O_RDWR); 283 if (p > 0) 284 goto gotpty; 285 } 286 } 287 fatal(f, "Out of ptys", 0); 288 /*NOTREACHED*/ 289 gotpty: 290 (void) ioctl(p, TIOCSWINSZ, &win); 291 netf = f; 292 line[sizeof(_PATH_DEV) - 1] = 't'; 293 t = open(line, O_RDWR); 294 if (t < 0) 295 fatal(f, line, 1); 296 if (fchmod(t, 0)) 297 fatal(f, line, 1); 298 (void)signal(SIGHUP, SIG_IGN); 299 vhangup(); 300 (void)signal(SIGHUP, SIG_DFL); 301 t = open(line, O_RDWR); 302 if (t < 0) 303 fatal(f, line, 1); 304 setup_term(t); 305 if (confirmed == 0) { 306 write(f, "", 1); 307 confirmed = 1; /* we sent the null! */ 308 } 309 #ifdef KERBEROS 310 if (encrypt) 311 (void) des_write(f, SECURE_MESSAGE, sizeof(SECURE_MESSAGE)); 312 313 if (use_kerberos == 0) 314 #endif 315 if (!authenticated && !hostok) 316 write(f, "rlogind: Host address mismatch.\r\n", 317 sizeof("rlogind: Host address mismatch.\r\n") - 1); 318 319 pid = fork(); 320 if (pid < 0) 321 fatal(f, "", 1); 322 if (pid == 0) { 323 if (setsid() < 0) 324 fatal(f, "setsid", 1); 325 if (ioctl(t, TIOCSCTTY, 0) < 0) 326 fatal(f, "ioctl(sctty)", 1); 327 (void)close(f); 328 (void)close(p); 329 dup2(t, STDIN_FILENO); 330 dup2(t, STDOUT_FILENO); 331 dup2(t, STDERR_FILENO); 332 (void)close(t); 333 334 if (authenticated) 335 execl(_PATH_LOGIN, "login", "-p", 336 "-h", hp->h_name, "-f", lusername, 0); 337 else 338 execl(_PATH_LOGIN, "login", "-p", 339 "-h", hp->h_name, lusername, 0); 340 fatal(STDERR_FILENO, _PATH_LOGIN, 1); 341 /*NOTREACHED*/ 342 } 343 close(t); 344 345 #ifdef KERBEROS 346 /* 347 * If encrypted, don't turn on NBIO or the des read/write 348 * routines will croak. 349 */ 350 351 if (!encrypt) 352 #endif 353 ioctl(f, FIONBIO, &on); 354 ioctl(p, FIONBIO, &on); 355 ioctl(p, TIOCPKT, &on); 356 signal(SIGCHLD, cleanup); 357 protocol(f, p); 358 signal(SIGCHLD, SIG_IGN); 359 cleanup(); 360 } 361 362 char magic[2] = { 0377, 0377 }; 363 char oobdata[] = {TIOCPKT_WINDOW}; 364 365 /* 366 * Handle a "control" request (signaled by magic being present) 367 * in the data stream. For now, we are only willing to handle 368 * window size changes. 369 */ 370 control(pty, cp, n) 371 int pty; 372 char *cp; 373 int n; 374 { 375 struct winsize w; 376 377 if (n < 4+sizeof (w) || cp[2] != 's' || cp[3] != 's') 378 return (0); 379 oobdata[0] &= ~TIOCPKT_WINDOW; /* we know he heard */ 380 bcopy(cp+4, (char *)&w, sizeof(w)); 381 w.ws_row = ntohs(w.ws_row); 382 w.ws_col = ntohs(w.ws_col); 383 w.ws_xpixel = ntohs(w.ws_xpixel); 384 w.ws_ypixel = ntohs(w.ws_ypixel); 385 (void)ioctl(pty, TIOCSWINSZ, &w); 386 return (4+sizeof (w)); 387 } 388 389 /* 390 * rlogin "protocol" machine. 391 */ 392 protocol(f, p) 393 register int f, p; 394 { 395 char pibuf[1024+1], fibuf[1024], *pbp, *fbp; 396 register pcc = 0, fcc = 0; 397 int cc, nfd, n; 398 char cntl; 399 400 /* 401 * Must ignore SIGTTOU, otherwise we'll stop 402 * when we try and set slave pty's window shape 403 * (our controlling tty is the master pty). 404 */ 405 (void) signal(SIGTTOU, SIG_IGN); 406 send(f, oobdata, 1, MSG_OOB); /* indicate new rlogin */ 407 if (f > p) 408 nfd = f + 1; 409 else 410 nfd = p + 1; 411 if (nfd > FD_SETSIZE) { 412 syslog(LOG_ERR, "select mask too small, increase FD_SETSIZE"); 413 fatal(f, "internal error (select mask too small)", 0); 414 } 415 for (;;) { 416 fd_set ibits, obits, ebits, *omask; 417 418 FD_ZERO(&ebits); 419 FD_ZERO(&ibits); 420 FD_ZERO(&obits); 421 omask = (fd_set *)NULL; 422 if (fcc) { 423 FD_SET(p, &obits); 424 omask = &obits; 425 } else 426 FD_SET(f, &ibits); 427 if (pcc >= 0) 428 if (pcc) { 429 FD_SET(f, &obits); 430 omask = &obits; 431 } else 432 FD_SET(p, &ibits); 433 FD_SET(p, &ebits); 434 if ((n = select(nfd, &ibits, omask, &ebits, 0)) < 0) { 435 if (errno == EINTR) 436 continue; 437 fatal(f, "select", 1); 438 } 439 if (n == 0) { 440 /* shouldn't happen... */ 441 sleep(5); 442 continue; 443 } 444 #define pkcontrol(c) ((c)&(TIOCPKT_FLUSHWRITE|TIOCPKT_NOSTOP|TIOCPKT_DOSTOP)) 445 if (FD_ISSET(p, &ebits)) { 446 cc = read(p, &cntl, 1); 447 if (cc == 1 && pkcontrol(cntl)) { 448 cntl |= oobdata[0]; 449 send(f, &cntl, 1, MSG_OOB); 450 if (cntl & TIOCPKT_FLUSHWRITE) { 451 pcc = 0; 452 FD_CLR(p, &ibits); 453 } 454 } 455 } 456 if (FD_ISSET(f, &ibits)) { 457 #ifdef KERBEROS 458 if (encrypt) 459 fcc = des_read(f, fibuf, sizeof(fibuf)); 460 else 461 #endif 462 fcc = read(f, fibuf, sizeof(fibuf)); 463 if (fcc < 0 && errno == EWOULDBLOCK) 464 fcc = 0; 465 else { 466 register char *cp; 467 int left, n; 468 469 if (fcc <= 0) 470 break; 471 fbp = fibuf; 472 473 top: 474 for (cp = fibuf; cp < fibuf+fcc-1; cp++) 475 if (cp[0] == magic[0] && 476 cp[1] == magic[1]) { 477 left = fcc - (cp-fibuf); 478 n = control(p, cp, left); 479 if (n) { 480 left -= n; 481 if (left > 0) 482 bcopy(cp+n, cp, left); 483 fcc -= n; 484 goto top; /* n^2 */ 485 } 486 } 487 FD_SET(p, &obits); /* try write */ 488 } 489 } 490 491 if (FD_ISSET(p, &obits) && fcc > 0) { 492 cc = write(p, fbp, fcc); 493 if (cc > 0) { 494 fcc -= cc; 495 fbp += cc; 496 } 497 } 498 499 if (FD_ISSET(p, &ibits)) { 500 pcc = read(p, pibuf, sizeof (pibuf)); 501 pbp = pibuf; 502 if (pcc < 0 && errno == EWOULDBLOCK) 503 pcc = 0; 504 else if (pcc <= 0) 505 break; 506 else if (pibuf[0] == 0) { 507 pbp++, pcc--; 508 #ifdef KERBEROS 509 if (!encrypt) 510 #endif 511 FD_SET(f, &obits); /* try write */ 512 } else { 513 if (pkcontrol(pibuf[0])) { 514 pibuf[0] |= oobdata[0]; 515 send(f, &pibuf[0], 1, MSG_OOB); 516 } 517 pcc = 0; 518 } 519 } 520 if ((FD_ISSET(f, &obits)) && pcc > 0) { 521 #ifdef KERBEROS 522 if (encrypt) 523 cc = des_write(f, pbp, pcc); 524 else 525 #endif 526 cc = write(f, pbp, pcc); 527 if (cc < 0 && errno == EWOULDBLOCK) { 528 /* 529 * This happens when we try write after read 530 * from p, but some old kernels balk at large 531 * writes even when select returns true. 532 */ 533 if (!FD_ISSET(p, &ibits)) 534 sleep(5); 535 continue; 536 } 537 if (cc > 0) { 538 pcc -= cc; 539 pbp += cc; 540 } 541 } 542 } 543 } 544 545 cleanup() 546 { 547 char *p; 548 549 p = line + sizeof(_PATH_DEV) - 1; 550 if (logout(p)) 551 logwtmp(p, "", ""); 552 (void)chmod(line, 0666); 553 (void)chown(line, 0, 0); 554 *p = 'p'; 555 (void)chmod(line, 0666); 556 (void)chown(line, 0, 0); 557 shutdown(netf, 2); 558 exit(1); 559 } 560 561 fatal(f, msg, syserr) 562 int f, syserr; 563 char *msg; 564 { 565 int len; 566 char buf[BUFSIZ], *bp = buf; 567 568 /* 569 * Prepend binary one to message if we haven't sent 570 * the magic null as confirmation. 571 */ 572 if (!confirmed) 573 *bp++ = '\01'; /* error indicator */ 574 if (syserr) 575 len = sprintf(bp, "rlogind: %s: %s.\r\n", 576 msg, strerror(errno)); 577 else 578 len = sprintf(bp, "rlogind: %s.\r\n", msg); 579 (void) write(f, buf, bp + len - buf); 580 exit(1); 581 } 582 583 do_rlogin(host) 584 char *host; 585 { 586 getstr(rusername, sizeof(rusername), "remuser too long"); 587 getstr(lusername, sizeof(lusername), "locuser too long"); 588 getstr(term+ENVSIZE, sizeof(term)-ENVSIZE, "Terminal type too long"); 589 590 pwd = getpwnam(lusername); 591 if (pwd == NULL) 592 return(-1); 593 if (pwd->pw_uid == 0) 594 return(-1); 595 return(ruserok(host, 0, rusername, lusername)); 596 } 597 598 599 getstr(buf, cnt, errmsg) 600 char *buf; 601 int cnt; 602 char *errmsg; 603 { 604 char c; 605 606 do { 607 if (read(0, &c, 1) != 1) 608 exit(1); 609 if (--cnt < 0) 610 fatal(STDOUT_FILENO, errmsg, 0); 611 *buf++ = c; 612 } while (c != 0); 613 } 614 615 extern char **environ; 616 617 setup_term(fd) 618 int fd; 619 { 620 register char *cp = index(term+ENVSIZE, '/'); 621 char *speed; 622 struct termios tt; 623 624 #ifndef notyet 625 tcgetattr(fd, &tt); 626 if (cp) { 627 *cp++ = '\0'; 628 speed = cp; 629 cp = index(speed, '/'); 630 if (cp) 631 *cp++ = '\0'; 632 cfsetspeed(&tt, atoi(speed)); 633 } 634 635 tt.c_iflag = TTYDEF_IFLAG; 636 tt.c_oflag = TTYDEF_OFLAG; 637 tt.c_lflag = TTYDEF_LFLAG; 638 tcsetattr(fd, TCSADFLUSH, &tt); 639 #else 640 if (cp) { 641 *cp++ = '\0'; 642 speed = cp; 643 cp = index(speed, '/'); 644 if (cp) 645 *cp++ = '\0'; 646 tcgetattr(fd, &tt); 647 cfsetspeed(&tt, atoi(speed)); 648 tcsetattr(fd, TCSADFLUSH, &tt); 649 } 650 #endif 651 652 env[0] = term; 653 env[1] = 0; 654 environ = env; 655 } 656 657 #ifdef KERBEROS 658 #define VERSION_SIZE 9 659 660 /* 661 * Do the remote kerberos login to the named host with the 662 * given inet address 663 * 664 * Return 0 on valid authorization 665 * Return -1 on valid authentication, no authorization 666 * Return >0 for error conditions 667 */ 668 do_krb_login(host, dest, encrypt) 669 char *host; 670 struct sockaddr_in *dest; 671 int encrypt; 672 { 673 int rc; 674 char instance[INST_SZ], version[VERSION_SIZE]; 675 long authopts = 0L; /* !mutual */ 676 struct sockaddr_in faddr; 677 678 kdata = (AUTH_DAT *) auth_buf; 679 ticket = (KTEXT) tick_buf; 680 681 instance[0] = '*'; 682 instance[1] = '\0'; 683 684 if (encrypt) { 685 rc = sizeof(faddr); 686 if (getsockname(0, &faddr, &rc)) 687 return(-1); 688 authopts = KOPT_DO_MUTUAL; 689 rc = krb_recvauth( 690 authopts, 0, 691 ticket, "rcmd", 692 instance, dest, &faddr, 693 kdata, "", schedule, version); 694 des_set_key(kdata->session, schedule); 695 696 } else { 697 rc = krb_recvauth( 698 authopts, 0, 699 ticket, "rcmd", 700 instance, dest, (struct sockaddr_in *) 0, 701 kdata, "", (bit_64 *) 0, version); 702 } 703 704 if (rc != KSUCCESS) 705 return(rc); 706 707 getstr(lusername, sizeof(lusername), "locuser"); 708 /* get the "cmd" in the rcmd protocol */ 709 getstr(term+ENVSIZE, sizeof(term)-ENVSIZE, "Terminal type"); 710 711 pwd = getpwnam(lusername); 712 if (pwd == NULL) 713 return(-1); 714 715 /* returns nonzero for no access */ 716 if (kuserok(kdata,lusername) != 0) 717 return(-1); 718 719 return(0); 720 721 } 722 #endif /* KERBEROS */ 723 724 usage() 725 { 726 #ifdef KERBEROS 727 syslog(LOG_ERR, "usage: rlogind [-aln] [-k | -v]"); 728 #else 729 syslog(LOG_ERR, "usage: rlogind [-aln]"); 730 #endif 731 } 732 733 /* 734 * Check whether host h is in our local domain, 735 * defined as sharing the last two components of the domain part, 736 * or the entire domain part if the local domain has only one component. 737 * If either name is unqualified (contains no '.'), 738 * assume that the host is local, as it will be 739 * interpreted as such. 740 */ 741 local_domain(h) 742 char *h; 743 { 744 char localhost[MAXHOSTNAMELEN]; 745 char *p1, *p2, *topdomain(); 746 747 localhost[0] = 0; 748 (void) gethostname(localhost, sizeof(localhost)); 749 p1 = topdomain(localhost); 750 p2 = topdomain(h); 751 if (p1 == NULL || p2 == NULL || !strcasecmp(p1, p2)) 752 return(1); 753 return(0); 754 } 755 756 char * 757 topdomain(h) 758 char *h; 759 { 760 register char *p; 761 char *maybe = NULL; 762 int dots = 0; 763 764 for (p = h + strlen(h); p >= h; p--) { 765 if (*p == '.') { 766 if (++dots == 2) 767 return (p); 768 maybe = p; 769 } 770 } 771 return (maybe); 772 } 773