Professional Documents
Culture Documents
Mavis
Mavis
COLLABORATORS
TITLE :
REVISION HISTORY
Contents
1 Introduction 1
1.1 Download . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2 Design overview 1
3 Authentication setups 1
4 Sample setups 2
5 Configuration Syntax 2
5.1 Standard Configuration Directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
5.2 Backend Module Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
5.2.1 The anonftp module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
5.2.1.1 Configuration directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
5.2.1.2 Railroad Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
5.2.2 The asciiftp module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
5.2.2.1 Configuration directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
5.2.2.2 Railroad Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
5.2.3 The auth module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
5.2.3.1 Configuration Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
5.2.3.2 Railroad Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
5.2.4 The cache module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
5.2.4.1 Configuration directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
5.2.4.2 Railroad Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
5.2.5 The external module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
5.2.5.1 Configuration directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
5.2.5.2 Railroad Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
5.2.6 The group module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
5.2.6.1 Configuration directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
5.2.7 The limit module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
5.2.7.1 Configuration directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
5.2.7.2 Railroad Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
5.2.8 The log module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
5.2.9 The PAM module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
5.2.9.1 Configuration directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
5.2.9.2 Railroad Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
5.2.10 The remote module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
5.2.10.1 Configuration directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
MAVIS - Modular Attribute-Value Interchange System iv
1 Introduction
The MAVIS libraries provide a modular and extensible protocol for authorization and authentication tasks. Authorization/au-
thentication modules are stackable and configurable. Both synchronous and asynchronous operation modes are available.
The modules are reentrant, but not thread-save.
1.1 Download
2 Design overview
The MAVIS system consists of the MAVIS library (libmavis.so) and various MAVIS modules (libmavis_*.so). The
library glues the modules together, sends requests to and receives answers from the modules. A module may answer (or modify)
a request or pass it on to the module loaded later. It may intercept and modify the response from that module.
Example: Consider the following set-up:
An incoming request, e.g. for FTP authentication, first reaches the log module, which simply passes it on to the limit module.
The limit module checks the IP address of the client and rejects the request if that address is blacklisted. Otherwise, the request
is passed on to the auth module, which leaves it alone and passes it on to the cache module. If the request is not cached within
the cache module it is passed on to the pam module, which sets some attribute-value pairs and sends the request back to the
cache module. The cache module in turn adds the request data to its cache database and passes it back the auth module for
authentication checking. [Remaining steps omitted.]
--. .-->
| |
.===|===<log>==============================================|===.
| | log -----’ |
| | request <----. |
>===|===<limit>============================================|===<
| ’--> client IP ------(YES)------> reject ----------->| |
| .--- blacklisted? .---> request | |
| | | | |
| (NO) (YES)-- add IP to --(NO)--’ |
| | blacklist? <-------. |
>===|===<auth>=============================================|===<
| | verify -----’ |
| | authentication <----. |
>===|===<cache>============================================|===<
| ’--> answer for request ---(YES)---> answer request -->| |
| .--- already cached? | |
| | | |
| (NO) cache -----’ |
| | request <----. |
>===|===<pam>==============================================|===<
| ’--> retrieve authentication information from ---------’ |
| PAM sub-system and system files |
’--------------------------------------------------------------’
3 Authentication setups
Some MAVIS modules have both synchronous and asynchronous operation modes. For low and medium performance applica-
tions it’s sufficient to have one authentication daemon processing all incoming requests, with all the MAVIS modules utilized by
MAVIS - Modular Attribute-Value Interchange System 2 / 22
mavisd operating synchronously. However, this introduces a serialization of all queries, causing requests that could immediately
be answered by e.g. the limit or cache module to be deferred until database queries got processed. One possible solution to rem-
edy this is to add one or more secondary authentication daemon for asynchronous processing of queries for synchronous-only
modules. The remote module automatically distributes queries between the configured MAVIS daemons.
4 Sample setups
1. Stand alone setup: Authentication requests are processed synchronously. Only recommended for low-latency modules
where no common database is required, e.g. the anonftp module.
.-----------.
.-----------. |
.-----------. |-|
| Client |-| |
|-----------| | |
| [ log ] | |-’
| [ ... ] |-’
‘-----------’
2. Remote authentication setup: Authentication request processing is done asynchronous by mavisd. Recommended for
medium-latency modules or modules that require access to shared data, e.g. the limit or cache module.
.------------. .-----------.
.------------. |<===>| mavisd |
.------------. |<=====>|-----------|
| Client |<=======>| [ log ] |
|------------| |-’ | [ limit ] |
| [ remote ] |-’ | [ auth ] |
‘------------’ | [ cache ] |
| [ ... ] |
‘-----------’
3. Remote authentication setup with redundancy: Recommended for high-latency modules that are only capable of syn-
chronous request processing, high- performance setups or where redundancy is desired, e.g. suitable for database access
modules.
.------------. .------------. .-----------.
.------------. |<===>| mavisd |<=======>| mavisd |
.------------. |<=====>|------------| .-----------.-|
| Client |<=======>| [ log ] |<=====>| mavisd | |
|------------| |-’ | [ limit ] | |-----------| |
| [ remote ] |-’ | [ auth ] | | [ log ] |-’
‘------------’ | [ cache ] | | [ ... ] |
| [ remote ] | | [ ... ] |
‘------------’ ‘-----------’
5 Configuration Syntax
MAVIS modules are configured within the context of the application utilizing them. There’s no special configuration file required
or even supported.
path = path
Top-level configuration directives common to all of the applications using the MAVIS interface are:
• include = config
Evaluates configuration file config.
• id = ID{ ... }
Defines a configuration section ID, which will be evaluated by a matching server process.
Standard configuration directives which may be used both at top-level and inside the ID sections are:
PARSE 1
AUTHOR 2
AUTHEN 4
ACCT 8
CONFIG 16
PACKET 32
HEX 64
LOCK 128
REGEX 256
ACL 512
RADIUS 1024
CMD 2049
BUFFER 4096
PROC 8192
NET 16384
PATH 32768
CONTROL 65536
INDEX 131072
AV 262144
MAVIS 524288
Not all of these debugging flags may have an actual effect. The flags are additive; use the special flag NONE to clear all flags,
use ALL to set all flags.
Debugging options may only be available when the package was configured with the --debug command line switch.
Example:
debug = ALL -PARSE -NET
• regex-match-case = ( yes | no )
Enables/disables case-sensitive regex pattern matching for the current context. Default: no.
• syslog ident = Ident
Set the syslog(3) identity. Defaults to the programs basename.
• syslog level = Level
Set the syslog(3) level. Default: INFO.
MAVIS - Modular Attribute-Value Interchange System 4 / 22
Standard configuration directives which may be used inside the ID section of MAVIS enabled applications are:
id = spawnd {
listen = { port = 21 }
debug = NET
background = no
spawn = { exec = /usr/local/libexec/ftpd }
}
id = ftpd {
debug = ACL AUTHEN
mavis path = /some/none/default/location
acl testacl {
src = 127.0.0.1
}
This module implements anonymous FTP authentication. If the cache module is to be used, it has to be loaded after the
anonftp module, because the cache module will only cache FTP type queries compatible with the auth module, and queries
answered by the anonftp module aren’t.
The following configuration directives are mandatory, unless a ftp user exists in the local password database, in which case that
information may be gathered from there:
• userid = UserID
• groupid = GroupID
• root = RootDirectory
• home = HomeDirectory
• upload = UploadPathRegex
By default, anonymous FTP uploads are denied. The upload directive specifies a POSIX regular expression where uploads
are permitted.
{ user-id = usernameOrUID }
group-id = groupnameOrUID
home = homeDirectory
root = rootDirectory
upload = uploadPath
script in = { MavisAction }
out
• file = path
Authentication data is read from path. The generic syntax for individual configuration file lines is:
user:password:uid:gids:type:root:home[:certsubj]
Example file:
customer1:whatever:10000:10001:anon:/home/customers/customer1:/
customer2:whatever:10000:10002:anon:/home/customers/customer2:/:/C=DE/ST=...
admin:whatever:10000:10001,10002:real:/home/customers:/admin
script in = { MavisAction }
out
This module implements the server side of plain text and certificate based authentication schemes.
The auth module is mandatory for most authentication to work. It needs to be loaded before any caching or database access
module, and it won’t work over remote links unless mavisd is configured with "transmit-password yes". The anonftp and,
depending on the backend, the external module are the only ones that doesn’t require this module to be loaded.
{ authmode = required }
sufficient
script in = { MavisAction }
out
This module stores the most recently answered queries in RAM for faster processing of subsequent queries for the same data.
For most applications, it has to be loaded after the auth module.
• purge-outdated = Seconds
Periodically, outdated entries have to be removed from the cache. By default, this happens every 300 seconds, but you may
specify a different garbage collection interval.
script in = { MavisAction }
out
This module implements an interface to external authentication programs. An authentication program is expected to read a list
of attribute-value pairs on stdin, and write the processed list (plus a result code) to stdout. The programs stderr output
will be logged to syslogd.
Sample authentication backends for the external module include various Perl scripts, e.g. for RADIUS and LDAP authen-
tication (see the mavis/perl/ directory), plus C backends. The latter are radmavis (for RADIUS authentication) and
pammavis (for PAM authentication, as an alternative to the PAM module). While those may not be as flexible and easily to
modify as the Perl scripts, they carry far fewer dependencies, and quite a lot of the usual attribute modifications can be performed
using scripts; see the Scripting section below.
Using the external module to interface to external authenticators is probably in most cases favourable to writing custom mod-
ules, as external authentication programs may be implemented as easy-to-deploy Perl programs. Plus, you’re likely to get get
parallelism for free.
Caveat Emptor
Chaining external modules in asynchronous mode may not work as expected. Just don’t do it.
• userid = UserID
Set user id of child process to UserID.
• groupid = GroupID
Set group id of child process to GroupID.
• home = Directory
Change to Directory before executing child process.
• childs ( min | max ) = Number
Set the minimum or maximum number of child processes (defaults: 4, 20).
{ user-id = usernameOrUID }
group-id = groupnameOrUID
home = homeDirectory
childs min = number
max
setenv name = value
argument
exec = execFile
script in = { MavisAction }
out
This module resolves numerical group IDs returned by a downstream backend to their corresponding ASCII names.
(regex syntax in these examples is PCRE, but standard POSIX will work, too.)
This module implements limitations on the number of failed authentications per IP address.
This module performs query logging to syslogd. There are no configuration options.
This module implements an interface for FTP authentication via pluggable authentication modules (PAM). The PAM module
doesn’t support asynchronous operation; you might be better off using the external module in conjunction with the pammavis
program, giving you parallelism and a lot more flexibility for free.
PAMs that perform queries other than the standard username/password aren’t supported.
Please take care not to use PAM modules with login delays enabled. E.g., for the pam_unix module, configure your PAM
subsystem to use the nodelay (or whatever it’s called in your setup) option, e.g. in /etc/pam.conf:
MAVIS - Modular Attribute-Value Interchange System 11 / 22
Programs utilizing this module may have to run under the user id of root if access to the shadow password file is required.
• chroot = ( yes | no )
This activates a chroot environment for PAM users (default: yes). The chroot root directory is either the users’ home directory
or, if the home directory path contains a /./ sequence, the directory denoted by the path up to that sequence.
• service = Service
This specifies the service name to use for PAM initialization. It defaults to mavis.
{ chroot = yes }
no
service = string
script in = { MavisAction }
out
– path = UnixPath
– address = IPAddress
– port = UDPPort
– blowfish key = Key
– blowfish keyfile = KeyFile
These set remote connection endpoint and blowfish key. This directive may be used multiple times. Communication will be
Blowfish encrypted if a key is specified.
Communication via PF_UNIX sockets may only work if the host system supports anonymous binds for that protocol family.
This works on Linux, which supports an abstract namespace which is independent of the file system, but may or may not be an
option on other operating systems.
• timeout = Seconds
Sets the maximum number of seconds to wait for a response from one of the remote peers. Defaults to: 5.
• tries = Count
Sets the maximum number of attempts to get a response from one of the remote peers. Default is 6 tries.
MAVIS - Modular Attribute-Value Interchange System 13 / 22
address = ipAddress
port = port
blowfish key = key
keyfile = keyFile
script in = { MavisAction }
out
script in = { MavisAction }
out
This module utilizes Bruce Schneier’s Blowfish algorithm. Your government may have choosen to implement ridiculous legal
restrictions regarding use or export of cryptographic software. Take care.
This module implements FTP authentication via UNIX system accounts or accounts defined in UNIX password-style files.
Optionally, certificate based authentication is available. Please note that the pam module may be a better choice for most
installations.
Programs utilizing this module will most likely have to run under the user id of root if access to the shadow password file is
required.
• chroot = ( yes | no )
This activates a chroot environment for system users (default: yes). The chroot root directory is either the users home directory
or, if the home directory path contains a /./ sequence, the directory denoted by the path up to that sequence.
• ftpusers file = Path
Select ftpusers file (default: /etc/ftpusers).
• passwd file = Path
Select UNIX password file. If this is omitted, the systems UNIX accounts are used. On *BSD systems you may wish to set
path to /etc/master.passwd.
MAVIS - Modular Attribute-Value Interchange System 14 / 22
where user1 and user2 are user names, and the /C=US/.... part is a certificate subject.
In case you’re unfamiliar with OpenSSL: you may retrieve the certificate subject of a certificate cert.pem using
openssl x509 -subject -noout -in cert.pem
{ chroot = yes }
no
passwd = passwdFile
ftpusers = ftpUsersFile
shells = shellsFile
sslusers = sslUsersFile
check = ftpusers
shells
sslusers
script in = { MavisAction }
out
This module can be used to define static users, e.g. for FTP. It requires the auth module for user authentication.
Syntax for defining users is user = UserName { ... }. The following configuration directives inside the curly brackets are
mandatory for FTP, but not enforced:
• userid = UserID
MAVIS - Modular Attribute-Value Interchange System 15 / 22
• groupid = GroupID
• home = HomeDirectory
• password = ( ( clear | crypt) PasswordString) | mavis
clear indicates a clear-text password, while crypt tells the parser that PasswordString is DES (or MD5) encrypted. The
mavis keyword expects the password to be set by a downstream module.
• root = RootDirectory
• cert subject = CertSubject
{ userid = userID }
groupid = groupID
home = homeDirectory
password = clear cleartextPassword
crypt hashedPassword
mavis
root = rootDirectory
cert subject = certSubject
set attribute = value
5.2.12.3 Example
The following is a valid configuration for ftpd which utilizes various MAVIS backends:
id = spawnd {
listen = { port = 21 }
spawn = { instances min = 1 }
background = no
}
id = ftpd {
mavis path = ../../mavis/obj.%O
root = /tmp/
home = /
upload = /tmp/incoming/
}
mavis module = auth {
}
mavis module = userdb {
user = test {
#password = clear test
password = crypt $1$j/K5hgl2$vyCmLeqUzQmr9DdyPTn01.
root = /tmp/
home = /
userid = 100
groupid = 100
}
}
symlinks = all
check-uid = no
check-gid = no
check-perm = no
}
This module is used for development only. It writes sent and received attribute-value pairs to disk in a format which may, for
example, be used to test external authenticators (see the description of the external module).
• userid = UserID
• groupid = GroupID
• mode = Mode
• path ( in | out ) Path
{ user-id = usernameOrUID }
group-id = groupnameOrUID
path in = file
out
mode = octalMask
script in = { MavisAction }
out
This module comes without any functionality on its own. It may however be used in conjunction with the scripting feature
described below.
All MAVIS modules in the distribution come with some basic scripting language support for modifying AV pair and/or module
behavior. Scripts can be called when entering or leaving a module and are defined using the script keyword.
Generic syntax for the scripting feature is:
script ( in | out ) ={ action+ }
Valid actions are:
• { action+ }
Defines an action block consisting of multiple actions.
• continue
Stops processing the remainder of the script and continues with regular module operation.
• return
Stops processing the remainder of the script and returns the currently set attributes to the caller.
• skip
Skips this module and continue with the next one.
• set attribute = value
Sets the specified MAVIS attribute. If the software was compiled with PCRE support (strongly recommended!), the strings $1
... $9 will be replaced with the substrings from the latest condition matching operation.
• unset attribute
Clears the specified MAVIS attribute.
• reset attribute
Resets the specified MAVIS attribute to its original value.
• toupper attribute
Converts the specified MAVIS attribute to upper case.
• tolower attribute
Converts the specified MAVIS attribute to lower case.
• eval condition
Evaluates condition, and populates the PCRE substring information vector ($1 ... $9).
• if ( condition ) action [ else action ]
Evaluates condition and executes one of the actions, if any.
• ! condition
Boolean negation.
• condition && condition
Boolean AND.
MAVIS - Modular Attribute-Value Interchange System 18 / 22
• condition || condition
Boolean OR.
• attribute == ( attribute | value )
Exact match.
• attribute != ( attribute | value )
No exact match.
• attribute =~ regex
Exact match. Enclose regex in / for PCRE.
• attribute !~ regex
No exact match.
• defined ( attribute )
TRUE if attribute is set, false else.
• undef ( attribute )
TRUE if attribute is not set, false else.
! MavisCond
( MavisCond )
defined ( MavisAttribute )
undef
MavisAttribute
MavisAttribute == MavisAttribute
!=
value
MavisAttribute =~ regEx
!~
continue
return
skip
As detailed in the PAM module section above, take care not to use a PAM service which implements login delays. The PAM
service can be selected using the -s pamservicename option and defaults to mavis. PAMs that perform queries other than
the standard username/password aren’t supported.
A more sophisticated (and complete) example for TACACS+:
id = spawnd { listen = { port = 49 } }
id = tac_plus {
mavis module = groups {
resolve gids = yes
groups filter = /^(guest|staff)$/
script out = {
# copy the already filtered UNIX group access list to TACMEMBER
eval $GIDS =~ /^(.*)$/
set $TACMEMBER = $1
}
}
mavis module = external {
exec = /usr/local/sbin/pammavis pammavis -s mavis
}
user backend = mavis
login backend = mavis
host = global { address = 0.0.0.0/0 key = mykey }
group = staff {
service = shell {
default command = permit
default command = permit
set priv-lvl = 15
}
}
group = guest {
service = shell {
default command = deny
set priv-lvl = 15
cmd = show { permit .* }
}
}
}
MAVIS - Modular Attribute-Value Interchange System 21 / 22
You’ll almost certainly want to validate that your backend configuration behaves as expected. You can do so using the mavist
est binary. Syntax is:
mavistest [options] <config> <id> <type> <user> [<password>]
Options:
-P (parse only)
-d <debuglevel> (set debug level)
Please see the source for copyright and licensing information of individual files.
• The following applies if the software was compiled with TLS support:
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit.
(http://www.openssl.org/)
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com).
• If the software was compiled with PCRE (Perl Compatible Regular Expressions) support, the following applies:
Regular expression support is provided by the PCRE library package, which is open source software, written by Philip Hazel,
and copyright by the University of Cambridge, England.
(ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/).
• MD5 algorithm
The software uses the RSA Data Security, Inc. MD5 Message-Digest Algorithm.
• The Blowfish algorithm:
This software uses Bruce Schneier’s Blowfish algorithm.
MAVIS - Modular Attribute-Value Interchange System 22 / 22
• md5crypt:
"THE BEER-WARE LICENSE" (Revision 42):
<phk@login.dknet.dk> wrote this file. As long as you retain this notice you
can do whatever you want with this stuff. If we meet some day, and you think
this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp
• Portions of the parsing code are taken from Cisco’s tac_plus developers kit which is distributed under the following
license:
Copyright (c) 1995-1998 by Cisco systems, Inc.
Permission to use, copy, modify, and distribute this software for any purpose and without fee is hereby granted, provided that
this copyright and permission notice appear on all copies of the software and supporting documentation, the name of Cisco
Systems, Inc. not be used in advertising or publicity pertaining to distribution of the program without specific prior permission,
and notice be given in supporting documentation that modification, copying and distribution is by permission of Cisco Systems,
Inc.
Cisco Systems, Inc. makes no representations about the suitability of this software for any purpose. THIS SOFTWARE IS
PROVIDED ``AS IS” AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMI-
TATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
• The code written by Marc Huber is distributed under the following license:
Copyright (C) 1999-2015 Marc Huber (Marc.Huber@web.de). All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following
conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following dis-
claimer in the documentation and/or other materials provided with the distribution.
3. The end-user documentation included with the redistribution, if any, must include the following acknowledgment:
This product includes software developed by Marc Huber (Marc.Huber@web.de).
Alternately, this acknowledgment may appear in the software itself, if and wherever such third-party acknowledgments
normally appear.
THIS SOFTWARE IS PROVIDED ``AS IS” AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT
NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITS AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS IN-
TERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.