src/main/auth.c

   1 /*
   2  * auth.c       User authentication.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2006  The FreeRADIUS server project
  21  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  22  * Copyright 2000  Jeff Carneal <jeff@apex.net>
  23  */
  24 RCSID("$Id$")
  25
  26 #include <freeradius-devel/radiusd.h>
  27 #include <freeradius-devel/modules.h>
  28 #include <freeradius-devel/rad_assert.h>
  29
  30 #include <ctype.h>
  31
  32 /*
  33  *      Return a short string showing the terminal server, port
  34  *      and calling station ID.
  35  */
  36 char *auth_name(char *buf, size_t buflen, REQUEST *request, bool do_cli)
  37 {
  38         VALUE_PAIR      *cli;
  39         VALUE_PAIR      *pair;
  40         int             port = 0;
  41         char const      *tls = "";
  42
  43         if ((cli = pairfind(request->packet->vps, PW_CALLING_STATION_ID, 0, TAG_ANY)) == NULL) {
  44                 do_cli = false;
  45         }
  46
  47         if ((pair = pairfind(request->packet->vps, PW_NAS_PORT, 0, TAG_ANY)) != NULL) {
  48                 port = pair->vp_integer;
  49         }
  50
  51         if (request->packet->dst_port == 0) {
  52                 if (pairfind(request->packet->vps, PW_FREERADIUS_PROXIED_TO, 0, TAG_ANY)) {
  53                         tls = " via TLS tunnel";
  54                 } else {
  55                         tls = " via proxy to virtual server";
  56                 }
  57         }
  58
  59         snprintf(buf, buflen, "from client %.128s port %u%s%.128s%s",
  60                         request->client->shortname, port,
  61                  (do_cli ? " cli " : ""), (do_cli ? cli->vp_strvalue : ""),
  62                  tls);
  63
  64         return buf;
  65 }
  66
  67
  68
  69 /*
  70  * Make sure user/pass are clean
  71  * and then log them
  72  */
  73 static int rad_authlog(char const *msg, REQUEST *request, int goodpass)
  74 {
  75         int logit;
  76         char const *extra_msg = NULL;
  77         char clean_password[1024];
  78         char clean_username[1024];
  79         char buf[1024];
  80         char extra[1024];
  81         char *p;
  82         VALUE_PAIR *username = NULL;
  83
  84         if (!request->root->log_auth) {
  85                 return 0;
  86         }
  87
  88         /*
  89          * Get the correct username based on the configured value
  90          */
  91         if (!log_stripped_names) {
  92                 username = pairfind(request->packet->vps, PW_USER_NAME, 0, TAG_ANY);
  93         } else {
  94                 username = request->username;
  95         }
  96
  97         /*
  98          *      Clean up the username
  99          */
 100         if (username == NULL) {
 101                 strcpy(clean_username, "<no User-Name attribute>");
 102         } else {
 103                 fr_print_string(username->vp_strvalue,
 104                                 username->length,
 105                                 clean_username, sizeof(clean_username));
 106         }
 107
 108         /*
 109          *      Clean up the password
 110          */
 111         if (request->root->log_auth_badpass || request->root->log_auth_goodpass) {
 112                 if (!request->password) {
 113                         VALUE_PAIR *auth_type;
 114
 115                         auth_type = pairfind(request->config_items, PW_AUTH_TYPE, 0, TAG_ANY);
 116                         if (auth_type) {
 117                                 snprintf(clean_password, sizeof(clean_password),
 118                                          "<via Auth-Type = %s>",
 119                                          dict_valnamebyattr(PW_AUTH_TYPE, 0,
 120                                                             auth_type->vp_integer));
 121                         } else {
 122                                 strcpy(clean_password, "<no User-Password attribute>");
 123                         }
 124                 } else if (pairfind(request->packet->vps, PW_CHAP_PASSWORD, 0, TAG_ANY)) {
 125                         strcpy(clean_password, "<CHAP-Password>");
 126                 } else {
 127                         fr_print_string(request->password->vp_strvalue,
 128                                          request->password->length,
 129                                          clean_password, sizeof(clean_password));
 130                 }
 131         }
 132
 133         if (goodpass) {
 134                 logit = request->root->log_auth_goodpass;
 135                 extra_msg = request->root->auth_goodpass_msg;
 136         } else {
 137                 logit = request->root->log_auth_badpass;
 138                 extra_msg = request->root->auth_badpass_msg;
 139         }
 140
 141         if (extra_msg) {
 142                 extra[0] = ' ';
 143                 p = extra + 1;
 144                 if (radius_xlat(p, sizeof(extra) - 1, request, extra_msg, NULL, NULL) < 0) {
 145                         return -1;
 146                 }
 147         } else {
 148                 *extra = '\0';
 149         }
 150
 151         RAUTH("%s: [%s%s%s] (%s)%s",
 152                        msg,
 153                        clean_username,
 154                        logit ? "/" : "",
 155                        logit ? clean_password : "",
 156                        auth_name(buf, sizeof(buf), request, 1),
 157                        extra);
 158
 159         return 0;
 160 }
 161
 162 /*
 163  *      Check password.
 164  *
 165  *      Returns:        0  OK
 166  *                      -1 Password fail
 167  *                      -2 Rejected (Auth-Type = Reject, send Port-Message back)
 168  *                      1  End check & return, don't reply
 169  *
 170  *      NOTE: NOT the same as the RLM_ values !
 171  */
 172 static int rad_check_password(REQUEST *request)
 173 {
 174         vp_cursor_t cursor;
 175         VALUE_PAIR *auth_type_pair;
 176         int auth_type = -1;
 177         int result;
 178         int auth_type_count = 0;
 179
 180         rad_assert(request != NULL);
 181
 182         /*
 183          *      Look for matching check items. We skip the whole lot
 184          *      if the authentication type is PW_AUTHTYPE_ACCEPT or
 185          *      PW_AUTHTYPE_REJECT.
 186          */
 187         paircursor(&cursor, &request->config_items);
 188         while ((auth_type_pair = pairfindnext(&cursor, PW_AUTH_TYPE, 0, TAG_ANY))) {
 189                 auth_type = auth_type_pair->vp_integer;
 190                 auth_type_count++;
 191
 192                 RDEBUG2("Found Auth-Type = %s", dict_valnamebyattr(PW_AUTH_TYPE, 0, auth_type));
 193                 if (auth_type == PW_AUTHTYPE_REJECT) {
 194                         RDEBUG2("Auth-Type = Reject, rejecting user");
 195
 196                         return -2;
 197                 }
 198         }
 199
 200         /*
 201          *      Warn if more than one Auth-Type was found, because only the last
 202          *      one found will actually be used.
 203          */
 204         if ((auth_type_count > 1) && (debug_flag)) {
 205                 RERROR("Warning:  Found %d auth-types on request for user '%s'",
 206                         auth_type_count, request->username->vp_strvalue);
 207         }
 208
 209         /*
 210          *      This means we have a proxy reply or an accept and it wasn't
 211          *      rejected in the above loop. So that means it is accepted and we
 212          *      do no further authentication.
 213          */
 214         if ((auth_type == PW_AUTHTYPE_ACCEPT)
 215 #ifdef WITH_PROXY
 216             || (request->proxy)
 217 #endif
 218             ) {
 219                 RDEBUG2("Auth-Type = Accept, accepting the user");
 220                 return 0;
 221         }
 222
 223         /*
 224          *      Check that Auth-Type has been set, and reject if not.
 225          *
 226          *      Do quick checks to see if Cleartext-Password or Crypt-Password have
 227          *      been set, and complain if so.
 228          */
 229         if (auth_type < 0) {
 230                 if (pairfind(request->config_items, PW_CRYPT_PASSWORD, 0, TAG_ANY) != NULL) {
 231                         RWDEBUG2("Please update your configuration, and remove 'Auth-Type = Crypt'");
 232                         RWDEBUG2("Use the PAP module instead.");
 233                 }
 234                 else if (pairfind(request->config_items, PW_CLEARTEXT_PASSWORD, 0, TAG_ANY) != NULL) {
 235                         RWDEBUG2("Please update your configuration, and remove 'Auth-Type = Local'");
 236                         RWDEBUG2("Use the PAP or CHAP modules instead.");
 237                 }
 238
 239                 /*
 240                  *      The admin hasn't told us how to
 241                  *      authenticate the user, so we reject them!
 242                  *
 243                  *      This is fail-safe.
 244                  */
 245
 246                 REDEBUG2("No Auth-Type found: rejecting the user via Post-Auth-Type = Reject");
 247                 return -2;
 248         }
 249
 250         /*
 251          *      See if there is a module that handles
 252          *      this Auth-Type, and turn the RLM_ return
 253          *      status into the values as defined at
 254          *      the top of this function.
 255          */
 256         result = process_authenticate(auth_type, request);
 257         switch (result) {
 258                 /*
 259                  *      An authentication module FAIL
 260                  *      return code, or any return code that
 261                  *      is not expected from authentication,
 262                  *      is the same as an explicit REJECT!
 263                  */
 264                 case RLM_MODULE_FAIL:
 265                 case RLM_MODULE_INVALID:
 266                 case RLM_MODULE_NOOP:
 267                 case RLM_MODULE_NOTFOUND:
 268                 case RLM_MODULE_REJECT:
 269                 case RLM_MODULE_UPDATED:
 270                 case RLM_MODULE_USERLOCK:
 271                 default:
 272                         result = -1;
 273                         break;
 274                 case RLM_MODULE_OK:
 275                         result = 0;
 276                         break;
 277                 case RLM_MODULE_HANDLED:
 278                         result = 1;
 279                         break;
 280         }
 281
 282         return result;
 283 }
 284
 285 /*
 286  *      Post-authentication step processes the response before it is
 287  *      sent to the NAS. It can receive both Access-Accept and Access-Reject
 288  *      replies.
 289  */
 290 int rad_postauth(REQUEST *request)
 291 {
 292         int     result;
 293         int     postauth_type = 0;
 294         VALUE_PAIR *vp;
 295
 296         /*
 297          *      Do post-authentication calls. ignoring the return code.
 298          */
 299         vp = pairfind(request->config_items, PW_POST_AUTH_TYPE, 0, TAG_ANY);
 300         if (vp) {
 301                 postauth_type = vp->vp_integer;
 302                 RDEBUG2("Using Post-Auth-Type %s",
 303                         dict_valnamebyattr(PW_POST_AUTH_TYPE, 0, postauth_type));
 304         }
 305         result = process_post_auth(postauth_type, request);
 306         switch (result) {
 307                 /*
 308                  *      The module failed, or said to reject the user: Do so.
 309                  */
 310                 case RLM_MODULE_FAIL:
 311                 case RLM_MODULE_INVALID:
 312                 case RLM_MODULE_REJECT:
 313                 case RLM_MODULE_USERLOCK:
 314                 default:
 315                         request->reply->code = PW_AUTHENTICATION_REJECT;
 316                         result = RLM_MODULE_REJECT;
 317                         break;
 318                 /*
 319                  *      The module handled the request, cancel the reply.
 320                  */
 321                 case RLM_MODULE_HANDLED:
 322                         /* FIXME */
 323                         break;
 324                 /*
 325                  *      The module had a number of OK return codes.
 326                  */
 327                 case RLM_MODULE_NOOP:
 328                 case RLM_MODULE_NOTFOUND:
 329                 case RLM_MODULE_OK:
 330                 case RLM_MODULE_UPDATED:
 331                         result = RLM_MODULE_OK;
 332                         break;
 333         }
 334         return result;
 335 }
 336
 337 /*
 338  *      Process and reply to an authentication request
 339  *
 340  *      The return value of this function isn't actually used right now, so
 341  *      it's not entirely clear if it is returning the right things. --Pac.
 342  */
 343 int rad_authenticate(REQUEST *request)
 344 {
 345 #ifdef WITH_SESSION_MGMT
 346         VALUE_PAIR      *check_item;
 347 #endif
 348         VALUE_PAIR      *module_msg;
 349         VALUE_PAIR      *tmp = NULL;
 350         int             result;
 351         char            autz_retry = 0;
 352         int             autz_type = 0;
 353
 354 #ifdef WITH_PROXY
 355         /*
 356          *      If this request got proxied to another server, we need
 357          *      to check whether it authenticated the request or not.
 358          */
 359         if (request->proxy_reply) {
 360                 switch (request->proxy_reply->code) {
 361                 /*
 362                  *      Reply of ACCEPT means accept, thus set Auth-Type
 363                  *      accordingly.
 364                  */
 365                 case PW_AUTHENTICATION_ACK:
 366                         tmp = radius_paircreate(request,
 367                                                 &request->config_items,
 368                                                 PW_AUTH_TYPE, 0);
 369                         if (tmp) tmp->vp_integer = PW_AUTHTYPE_ACCEPT;
 370                         goto authenticate;
 371
 372                 /*
 373                  *      Challenges are punted back to the NAS without any
 374                  *      further processing.
 375                  */
 376                 case PW_ACCESS_CHALLENGE:
 377                         request->reply->code = PW_ACCESS_CHALLENGE;
 378                         return RLM_MODULE_OK;
 379                 /*
 380                  *      ALL other replies mean reject. (this is fail-safe)
 381                  *
 382                  *      Do NOT do any authorization or authentication. They
 383                  *      are being rejected, so we minimize the amount of work
 384                  *      done by the server, by rejecting them here.
 385                  */
 386                 case PW_AUTHENTICATION_REJECT:
 387                         rad_authlog("Login incorrect (Home Server says so)",
 388                                     request, 0);
 389                         request->reply->code = PW_AUTHENTICATION_REJECT;
 390                         return RLM_MODULE_REJECT;
 391
 392                 default:
 393                         rad_authlog("Login incorrect (Home Server failed to respond)",
 394                                     request, 0);
 395                         return RLM_MODULE_REJECT;
 396                 }
 397         }
 398 #endif
 399         /*
 400          *      Look for, and cache, passwords.
 401          */
 402         if (!request->password) {
 403                 request->password = pairfind(request->packet->vps, PW_USER_PASSWORD, 0, TAG_ANY);
 404         }
 405         if (!request->password) {
 406                 request->password = pairfind(request->packet->vps, PW_CHAP_PASSWORD, 0, TAG_ANY);
 407         }
 408
 409         /*
 410          *      Get the user's authorization information from the database
 411          */
 412 autz_redo:
 413         result = process_authorize(autz_type, request);
 414         switch (result) {
 415                 case RLM_MODULE_NOOP:
 416                 case RLM_MODULE_NOTFOUND:
 417                 case RLM_MODULE_OK:
 418                 case RLM_MODULE_UPDATED:
 419                         break;
 420                 case RLM_MODULE_HANDLED:
 421                         return result;
 422                 case RLM_MODULE_FAIL:
 423                 case RLM_MODULE_INVALID:
 424                 case RLM_MODULE_REJECT:
 425                 case RLM_MODULE_USERLOCK:
 426                 default:
 427                         if ((module_msg = pairfind(request->packet->vps, PW_MODULE_FAILURE_MESSAGE, 0, TAG_ANY)) != NULL) {
 428                                 char msg[MAX_STRING_LEN + 16];
 429                                 snprintf(msg, sizeof(msg), "Invalid user (%s)",
 430                                          module_msg->vp_strvalue);
 431                                 rad_authlog(msg,request,0);
 432                         } else {
 433                                 rad_authlog("Invalid user", request, 0);
 434                         }
 435                         request->reply->code = PW_AUTHENTICATION_REJECT;
 436                         return result;
 437         }
 438         if (!autz_retry) {
 439                 tmp = pairfind(request->config_items, PW_AUTZ_TYPE, 0, TAG_ANY);
 440                 if (tmp) {
 441                         autz_type = tmp->vp_integer;
 442                         RDEBUG2("Using Autz-Type %s",
 443                                 dict_valnamebyattr(PW_AUTZ_TYPE, 0, autz_type));
 444                         autz_retry = 1;
 445                         goto autz_redo;
 446                 }
 447         }
 448
 449         /*
 450          *      If we haven't already proxied the packet, then check
 451          *      to see if we should.  Maybe one of the authorize
 452          *      modules has decided that a proxy should be used. If
 453          *      so, get out of here and send the packet.
 454          */
 455         if (
 456 #ifdef WITH_PROXY
 457             (request->proxy == NULL) &&
 458 #endif
 459             ((tmp = pairfind(request->config_items, PW_PROXY_TO_REALM, 0, TAG_ANY)) != NULL)) {
 460                 REALM *realm;
 461
 462                 realm = realm_find2(tmp->vp_strvalue);
 463
 464                 /*
 465                  *      Don't authenticate, as the request is going to
 466                  *      be proxied.
 467                  */
 468                 if (realm && realm->auth_pool) {
 469                         return RLM_MODULE_OK;
 470                 }
 471
 472                 /*
 473                  *      Catch users who set Proxy-To-Realm to a LOCAL
 474                  *      realm (sigh).  But don't complain if it is
 475                  *      *the* LOCAL realm.
 476                  */
 477                 if (realm &&(strcmp(realm->name, "LOCAL") != 0)) {
 478                         RWDEBUG2("You set Proxy-To-Realm = %s, but it is a LOCAL realm!  Cancelling proxy request.", realm->name);
 479                 }
 480
 481                 if (!realm) {
 482                         RWDEBUG2("You set Proxy-To-Realm = %s, but the realm does not exist!  Cancelling invalid proxy request.", tmp->vp_strvalue);
 483                 }
 484         }
 485
 486 #ifdef WITH_PROXY
 487  authenticate:
 488 #endif
 489
 490         /*
 491          *      Validate the user
 492          */
 493         do {
 494                 result = rad_check_password(request);
 495                 if (result > 0) {
 496                         /* don't reply! */
 497                         return RLM_MODULE_HANDLED;
 498                 }
 499         } while(0);
 500
 501         /*
 502          *      Failed to validate the user.
 503          *
 504          *      We PRESUME that the code which failed will clean up
 505          *      request->reply->vps, to be ONLY the reply items it
 506          *      wants to send back.
 507          */
 508         if (result < 0) {
 509                 RDEBUG2("Failed to authenticate the user.");
 510                 request->reply->code = PW_AUTHENTICATION_REJECT;
 511
 512                 if ((module_msg = pairfind(request->packet->vps, PW_MODULE_FAILURE_MESSAGE, 0, TAG_ANY)) != NULL){
 513                         char msg[MAX_STRING_LEN+19];
 514
 515                         snprintf(msg, sizeof(msg), "Login incorrect (%s)",
 516                                  module_msg->vp_strvalue);
 517                         rad_authlog(msg, request, 0);
 518                 } else {
 519                         rad_authlog("Login incorrect", request, 0);
 520                 }
 521
 522                 if (request->password) {
 523                         VERIFY_VP(request->password);
 524                         /* double check: maybe the secret is wrong? */
 525                         if ((debug_flag > 1) && (request->password->da->attr == PW_USER_PASSWORD)) {
 526                                 uint8_t const *p;
 527
 528                                 p = (uint8_t const *) request->password->vp_strvalue;
 529                                 while (*p) {
 530                                         int size;
 531
 532                                         size = fr_utf8_char(p);
 533                                         if (!size) {
 534                                                 RWDEBUG("Unprintable characters in the password.  Double-check the "
 535                                                         "shared secret on the server and the NAS!");
 536                                                 break;
 537                                         }
 538                                         p += size;
 539                                 }
 540                         }
 541                 }
 542         }
 543
 544 #ifdef WITH_SESSION_MGMT
 545         if (result >= 0 &&
 546             (check_item = pairfind(request->config_items, PW_SIMULTANEOUS_USE, 0, TAG_ANY)) != NULL) {
 547                 int r, session_type = 0;
 548                 char            logstr[1024];
 549                 char            umsg[MAX_STRING_LEN + 1];
 550                 char const      *user_msg = NULL;
 551
 552                 tmp = pairfind(request->config_items, PW_SESSION_TYPE, 0, TAG_ANY);
 553                 if (tmp) {
 554                         session_type = tmp->vp_integer;
 555                         RDEBUG2("Using Session-Type %s",
 556                                 dict_valnamebyattr(PW_SESSION_TYPE, 0, session_type));
 557                 }
 558
 559                 /*
 560                  *      User authenticated O.K. Now we have to check
 561                  *      for the Simultaneous-Use parameter.
 562                  */
 563                 if (request->username &&
 564                     (r = process_checksimul(session_type, request, check_item->vp_integer)) != 0) {
 565                         char mpp_ok = 0;
 566
 567                         if (r == 2){
 568                                 /* Multilink attempt. Check if port-limit > simultaneous-use */
 569                                 VALUE_PAIR *port_limit;
 570
 571                                 if ((port_limit = pairfind(request->reply->vps, PW_PORT_LIMIT, 0, TAG_ANY)) != NULL &&
 572                                         port_limit->vp_integer > check_item->vp_integer){
 573                                         RDEBUG2("MPP is OK");
 574                                         mpp_ok = 1;
 575                                 }
 576                         }
 577                         if (!mpp_ok){
 578                                 if (check_item->vp_integer > 1) {
 579                                 snprintf(umsg, sizeof(umsg),
 580                                                         "\r\nYou are already logged in %d times  - access denied\r\n\n",
 581                                                         (int)check_item->vp_integer);
 582                                         user_msg = umsg;
 583                                 } else {
 584                                         user_msg = "\r\nYou are already logged in - access denied\r\n\n";
 585                                 }
 586
 587                                 request->reply->code = PW_AUTHENTICATION_REJECT;
 588
 589                                 /*
 590                                  *      They're trying to log in too many times.
 591                                  *      Remove ALL reply attributes.
 592                                  */
 593                                 pairfree(&request->reply->vps);
 594                                 pairmake_reply("Reply-Message",
 595                                                user_msg, T_OP_SET);
 596
 597                                 snprintf(logstr, sizeof(logstr), "Multiple logins (max %d) %s",
 598                                         check_item->vp_integer,
 599                                         r == 2 ? "[MPP attempt]" : "");
 600                                 rad_authlog(logstr, request, 1);
 601
 602                                 result = -1;
 603                         }
 604                 }
 605         }
 606 #endif
 607
 608         /*
 609          *      Result should be >= 0 here - if not, it means the user
 610          *      is rejected, so we just process post-auth and return.
 611          */
 612         if (result < 0) {
 613                 return RLM_MODULE_REJECT;
 614         }
 615
 616         /*
 617          *      Set the reply to Access-Accept, if it hasn't already
 618          *      been set to something.  (i.e. Access-Challenge)
 619          */
 620         if (request->reply->code == 0)
 621           request->reply->code = PW_AUTHENTICATION_ACK;
 622
 623         if ((module_msg = pairfind(request->packet->vps, PW_MODULE_SUCCESS_MESSAGE, 0, TAG_ANY)) != NULL){
 624                 char msg[MAX_STRING_LEN+12];
 625
 626                 snprintf(msg, sizeof(msg), "Login OK (%s)",
 627                          module_msg->vp_strvalue);
 628                 rad_authlog(msg, request, 1);
 629         } else {
 630                 rad_authlog("Login OK", request, 1);
 631         }
 632
 633         return result;
 634 }
 635
 636 /*
 637  *      Run a virtual server auth and postauth
 638  *
 639  */
 640 int rad_virtual_server(REQUEST *request)
 641 {
 642         VALUE_PAIR *vp;
 643         int result;
 644
 645         /*
 646          *      We currently only handle AUTH packets here.
 647          *      This could be expanded to handle other packets as well if required.
 648          */
 649         rad_assert(request->packet->code == PW_AUTHENTICATION_REQUEST);
 650
 651         result = rad_authenticate(request);
 652
 653         if (request->reply->code == PW_AUTHENTICATION_REJECT) {
 654                 pairdelete(&request->config_items, PW_POST_AUTH_TYPE, 0, TAG_ANY);
 655                 vp = pairmake_config("Post-Auth-Type", "Reject", T_OP_SET);
 656                 if (vp) rad_postauth(request);
 657         }
 658
 659         if (request->reply->code == PW_AUTHENTICATION_ACK) {
 660                 rad_postauth(request);
 661         }
 662
 663         return result;
 664 }
 665