355 lines
20 KiB
HTML
355 lines
20 KiB
HTML
<HTML><HEAD><TITLE>Tcl Tcl Built-In Commands - Safe manual page</TITLE></HEAD><BODY>
|
|
<DL>
|
|
<DD><A HREF="safe.htm#M2" NAME="L1021">NAME</A>
|
|
<DL><DD>Safe Base - A mechanism for creating and manipulating safe interpreters.</DL>
|
|
<DD><A HREF="safe.htm#M3" NAME="L1022">SYNOPSIS</A>
|
|
<DL>
|
|
<DD><B>::safe::interpCreate</B> ?<I>slave</I>? ?<I>options...</I>?
|
|
<DD><B>::safe::interpInit</B> <I>slave</I> ?<I>options...</I>?
|
|
<DD><B>::safe::interpConfigure</B> <I>slave</I> ?<I>options...</I>?
|
|
<DD><B>::safe::interpDelete</B> <I>slave</I>
|
|
<DD><B>::safe::interpAddToAccessPath</B> <I>slave</I> <I>directory</I>
|
|
<DD><B>::safe::interpFindInAccessPath</B> <I>slave</I> <I>directory</I>
|
|
<DD><B>::safe::setLogCmd</B> ?<I>cmd arg...</I>?
|
|
</DL>
|
|
<DD><A HREF="safe.htm#M4" NAME="L1023">OPTIONS</A>
|
|
<DD><A HREF="safe.htm#M5" NAME="L1024">DESCRIPTION</A>
|
|
<DD><A HREF="safe.htm#M6" NAME="L1025">COMMANDS</A>
|
|
<DL>
|
|
<DD><A HREF="safe.htm#M7" NAME="L1026"><B>::safe::interpCreate</B> ?<I>slave</I>? ?<I>options...</I>?</A>
|
|
<DD><A HREF="safe.htm#M8" NAME="L1027"><B>::safe::interpInit</B> <I>slave</I> ?<I>options...</I>?</A>
|
|
<DD><A HREF="safe.htm#M9" NAME="L1028"><B>::safe::interpConfigure</B> <I>slave</I> ?<I>options...</I>?</A>
|
|
<DD><A HREF="safe.htm#M10" NAME="L1029"><B>::safe::interpDelete</B> <I>slave</I></A>
|
|
<DD><A HREF="safe.htm#M11" NAME="L1030"><B>::safe::interpFindInAccessPath</B> <I>slave</I> <I>directory</I></A>
|
|
<DD><A HREF="safe.htm#M12" NAME="L1031"><B>::safe::interpAddToAccessPath</B> <I>slave</I> <I>directory</I></A>
|
|
<DD><A HREF="safe.htm#M13" NAME="L1032"><B>::safe::setLogCmd</B> ?<I>cmd arg...</I>?</A>
|
|
</DL>
|
|
<DD><A HREF="safe.htm#M14" NAME="L1033">OPTIONS</A>
|
|
<DL>
|
|
<DD><A HREF="safe.htm#M15" NAME="L1034"><B>-accessPath</B> <I>directoryList</I></A>
|
|
<DD><A HREF="safe.htm#M16" NAME="L1035"><B>-statics</B> <I>boolean</I></A>
|
|
<DD><A HREF="safe.htm#M17" NAME="L1036"><B>-noStatics</B></A>
|
|
<DD><A HREF="safe.htm#M18" NAME="L1037"><B>-nested</B> <I>boolean</I></A>
|
|
<DD><A HREF="safe.htm#M19" NAME="L1038"><B>-nestedLoadOk</B></A>
|
|
<DD><A HREF="safe.htm#M20" NAME="L1039"><B>-deleteHook</B> <I>script</I></A>
|
|
</DL>
|
|
<DD><A HREF="safe.htm#M21" NAME="L1040">ALIASES</A>
|
|
<DL>
|
|
<DD><A HREF="safe.htm#M22" NAME="L1041"><B>source</B> <I>fileName</I></A>
|
|
<DD><A HREF="safe.htm#M23" NAME="L1042"><B>load</B> <I>fileName</I></A>
|
|
<DD><A HREF="safe.htm#M24" NAME="L1043"><B>file</B> ?<I>subCmd args...</I>?</A>
|
|
<DD><A HREF="safe.htm#M25" NAME="L1044"><B>encoding</B> ?<I>subCmd args...</I>?</A>
|
|
<DD><A HREF="safe.htm#M26" NAME="L1045"><B>exit</B></A>
|
|
</DL>
|
|
<DD><A HREF="safe.htm#M27" NAME="L1046">SECURITY</A>
|
|
<DD><A HREF="safe.htm#M28" NAME="L1047">SEE ALSO</A>
|
|
<DD><A HREF="safe.htm#M29" NAME="L1048">KEYWORDS</A>
|
|
</DL><HR>
|
|
<H3><A NAME="M2">NAME</A></H3>
|
|
Safe Base - A mechanism for creating and manipulating safe interpreters.
|
|
<H3><A NAME="M3">SYNOPSIS</A></H3>
|
|
<B>::safe::interpCreate</B> ?<I>slave</I>? ?<I>options...</I>?<BR>
|
|
<B>::safe::interpInit</B> <I>slave</I> ?<I>options...</I>?<BR>
|
|
<B>::safe::interpConfigure</B> <I>slave</I> ?<I>options...</I>?<BR>
|
|
<B>::safe::interpDelete</B> <I>slave</I><BR>
|
|
<B>::safe::interpAddToAccessPath</B> <I>slave</I> <I>directory</I><BR>
|
|
<B>::safe::interpFindInAccessPath</B> <I>slave</I> <I>directory</I><BR>
|
|
<B>::safe::setLogCmd</B> ?<I>cmd arg...</I>?<BR>
|
|
<H3><A NAME="M4">OPTIONS</A></H3>
|
|
?<B>-accessPath</B> <I>pathList</I>?
|
|
?<B>-statics</B> <I>boolean</I>? ?<B>-noStatics</B>?
|
|
?<B>-nested</B> <I>boolean</I>? ?<B>-nestedLoadOk</B>?
|
|
?<B>-deleteHook</B> <I>script</I>?
|
|
<H3><A NAME="M5">DESCRIPTION</A></H3>
|
|
Safe Tcl is a mechanism for executing untrusted Tcl scripts
|
|
safely and for providing mediated access by such scripts to
|
|
potentially dangerous functionality.
|
|
<P>
|
|
The Safe Base ensures that untrusted Tcl scripts cannot harm the
|
|
hosting application.
|
|
The Safe Base prevents integrity and privacy attacks. Untrusted Tcl
|
|
scripts are prevented from corrupting the state of the hosting
|
|
application or computer. Untrusted scripts are also prevented from
|
|
disclosing information stored on the hosting computer or in the
|
|
hosting application to any party.
|
|
<P>
|
|
The Safe Base allows a master interpreter to create safe, restricted
|
|
interpreters that contain a set of predefined aliases for the <B><A HREF="../TkCmd/source.htm">source</A></B>,
|
|
<B><A HREF="../TkCmd/load.htm">load</A></B>, <B><A HREF="../TkCmd/file.htm">file</A></B>, <B><A HREF="../TkCmd/encoding.htm">encoding</A></B>, and <B><A HREF="../TkCmd/exit.htm">exit</A></B> commands and
|
|
are able to use the auto-loading and package mechanisms.
|
|
<P>
|
|
No knowledge of the file system structure is leaked to the
|
|
safe interpreter, because it has access only to a virtualized path
|
|
containing tokens. When the safe interpreter requests to source a file, it
|
|
uses the token in the virtual path as part of the file name to source; the
|
|
master interpreter transparently
|
|
translates the token into a real directory name and executes the
|
|
requested operation (see the section <B>SECURITY</B> below for details).
|
|
Different levels of security can be selected by using the optional flags
|
|
of the commands described below.
|
|
<P>
|
|
All commands provided in the master interpreter by the Safe Base reside in
|
|
the <B>safe</B> namespace:
|
|
|
|
<H3><A NAME="M6">COMMANDS</A></H3>
|
|
The following commands are provided in the master interpreter:
|
|
<P>
|
|
<DL>
|
|
<P><DT><A NAME="M7"><B>::safe::interpCreate</B> ?<I>slave</I>? ?<I>options...</I>?</A><DD>
|
|
Creates a safe interpreter, installs the aliases described in the section
|
|
<B>ALIASES</B> and initializes the auto-loading and package mechanism as
|
|
specified by the supplied <B><A HREF="../TclCmd/options.htm">options</A></B>.
|
|
See the <B><A HREF="../TclCmd/options.htm">OPTIONS</A></B> section below for a description of the
|
|
optional arguments.
|
|
If the <I>slave</I> argument is omitted, a name will be generated.
|
|
<B>::safe::interpCreate</B> always returns the interpreter name.
|
|
<P><DT><A NAME="M8"><B>::safe::interpInit</B> <I>slave</I> ?<I>options...</I>?</A><DD>
|
|
This command is similar to <B>interpCreate</B> except it that does not
|
|
create the safe interpreter. <I>slave</I> must have been created by some
|
|
other means, like <B>interp create -safe</B>.
|
|
<P><DT><A NAME="M9"><B>::safe::interpConfigure</B> <I>slave</I> ?<I>options...</I>?</A><DD>
|
|
If no <I>options</I> are given, returns the settings for all options for the
|
|
named safe interpreter as a list of options and their current values
|
|
for that <I>slave</I>.
|
|
If a single additional argument is provided,
|
|
it will return a list of 2 elements <I>name</I> and <I>value</I> where
|
|
<I>name</I> is the full name of that option and <I>value</I> the current value
|
|
for that option and the <I>slave</I>.
|
|
If more than two additional arguments are provided, it will reconfigure the
|
|
safe interpreter and change each and only the provided options.
|
|
See the section on <B><A HREF="../TclCmd/options.htm">OPTIONS</A></B> below for options description.
|
|
Example of use:
|
|
<PRE># Create a new interp with the same configuration as "$i0" :
|
|
set i1 [eval safe::interpCreate [safe::interpConfigure $i0]]
|
|
# Get the current deleteHook
|
|
set dh [safe::interpConfigure $i0 -del]
|
|
# Change (only) the statics loading ok attribute of an interp
|
|
# and its deleteHook (leaving the rest unchanged) :
|
|
safe::interpConfigure $i0 -delete {foo bar} -statics 0 ;</PRE>
|
|
<P><DT><A NAME="M10"><B>::safe::interpDelete</B> <I>slave</I></A><DD>
|
|
Deletes the safe interpreter and cleans up the corresponding
|
|
master interpreter data structures.
|
|
If a <I>deleteHook</I> script was specified for this interpreter it is
|
|
evaluated before the interpreter is deleted, with the name of the
|
|
interpreter as an additional argument.
|
|
<P><DT><A NAME="M11"><B>::safe::interpFindInAccessPath</B> <I>slave</I> <I>directory</I></A><DD>
|
|
This command finds and returns the token for the real directory
|
|
<I>directory</I> in the safe interpreter's current virtual access path.
|
|
It generates an error if the directory is not found.
|
|
Example of use:
|
|
<PRE>$slave eval [list set tk_library [::safe::interpFindInAccessPath $name $tk_library]]</PRE>
|
|
<P><DT><A NAME="M12"><B>::safe::interpAddToAccessPath</B> <I>slave</I> <I>directory</I></A><DD>
|
|
This command adds <I>directory</I> to the virtual path maintained for the
|
|
safe interpreter in the master, and returns the token that can be used in
|
|
the safe interpreter to obtain access to files in that directory.
|
|
If the directory is already in the virtual path, it only returns the token
|
|
without adding the directory to the virtual path again.
|
|
Example of use:
|
|
<PRE>$slave eval [list set tk_library [::safe::interpAddToAccessPath $name $tk_library]]</PRE>
|
|
<P><DT><A NAME="M13"><B>::safe::setLogCmd</B> ?<I>cmd arg...</I>?</A><DD>
|
|
This command installs a script that will be called when interesting
|
|
life cycle events occur for a safe interpreter.
|
|
When called with no arguments, it returns the currently installed script.
|
|
When called with one argument, an empty string, the currently installed
|
|
script is removed and logging is turned off.
|
|
The script will be invoked with one additional argument, a string
|
|
describing the event of interest.
|
|
The main purpose is to help in debugging safe interpreters.
|
|
Using this facility you can get complete error messages while the safe
|
|
interpreter gets only generic error messages.
|
|
This prevents a safe interpreter from seeing messages about failures
|
|
and other events that might contain sensitive information such as real
|
|
directory names.
|
|
<DL><P><DD>
|
|
Example of use:
|
|
<PRE>::safe::setLogCmd puts stderr</PRE>
|
|
Below is the output of a sample session in which a safe interpreter
|
|
attempted to source a file not found in its virtual access path.
|
|
Note that the safe interpreter only received an error message saying that
|
|
the file was not found:
|
|
<PRE>NOTICE for slave interp10 : Created
|
|
NOTICE for slave interp10 : Setting accessPath=(/foo/bar) staticsok=1 nestedok=0 deletehook=()
|
|
NOTICE for slave interp10 : auto_path in interp10 has been set to {$p(:0:)}
|
|
ERROR for slave interp10 : /foo/bar/init.tcl: no such file or directory</PRE>
|
|
</DL>
|
|
<P></DL>
|
|
<H3><A NAME="M14">OPTIONS</A></H3>
|
|
The following options are common to
|
|
<B>::safe::interpCreate</B>, <B>::safe::interpInit</B>,
|
|
and <B>::safe::interpConfigure</B>.
|
|
Any option name can be abbreviated to its minimal
|
|
non-ambiguous name.
|
|
Option names are not case sensitive.
|
|
<P>
|
|
<DL>
|
|
<P><DT><A NAME="M15"><B>-accessPath</B> <I>directoryList</I></A><DD>
|
|
This option sets the list of directories from which the safe interpreter
|
|
can <B><A HREF="../TkCmd/source.htm">source</A></B> and <B><A HREF="../TkCmd/load.htm">load</A></B> files.
|
|
If this option is not specified, or if it is given as the
|
|
empty list, the safe interpreter will use the same directories as its
|
|
master for auto-loading.
|
|
See the section <B>SECURITY</B> below for more detail about virtual paths,
|
|
tokens and access control.
|
|
<P><DT><A NAME="M16"><B>-statics</B> <I>boolean</I></A><DD>
|
|
This option specifies if the safe interpreter will be allowed
|
|
to load statically linked packages (like <B>load {} Tk</B>).
|
|
The default value is <B>true</B> :
|
|
safe interpreters are allowed to load statically linked packages.
|
|
<P><DT><A NAME="M17"><B>-noStatics</B></A><DD>
|
|
This option is a convenience shortcut for <B>-statics false</B> and
|
|
thus specifies that the safe interpreter will not be allowed
|
|
to load statically linked packages.
|
|
<P><DT><A NAME="M18"><B>-nested</B> <I>boolean</I></A><DD>
|
|
This option specifies if the safe interpreter will be allowed
|
|
to load packages into its own sub-interpreters.
|
|
The default value is <B>false</B> :
|
|
safe interpreters are not allowed to load packages into
|
|
their own sub-interpreters.
|
|
<P><DT><A NAME="M19"><B>-nestedLoadOk</B></A><DD>
|
|
This option is a convenience shortcut for <B>-nested true</B> and
|
|
thus specifies the safe interpreter will be allowed
|
|
to load packages into its own sub-interpreters.
|
|
<P><DT><A NAME="M20"><B>-deleteHook</B> <I>script</I></A><DD>
|
|
When this option is given an non empty <I>script</I>, it will be
|
|
evaluated in the master with the name of
|
|
the safe interpreter as an additional argument
|
|
just before actually deleting the safe interpreter.
|
|
Giving an empty value removes any currently installed deletion hook
|
|
script for that safe interpreter.
|
|
The default value (<B>{}</B>) is not to have any deletion call back.
|
|
<P></DL>
|
|
<H3><A NAME="M21">ALIASES</A></H3>
|
|
The following aliases are provided in a safe interpreter:
|
|
<P>
|
|
<DL>
|
|
<P><DT><A NAME="M22"><B>source</B> <I>fileName</I></A><DD>
|
|
The requested file, a Tcl source file, is sourced into the safe interpreter
|
|
if it is found.
|
|
The <B><A HREF="../TkCmd/source.htm">source</A></B> alias can only source files from directories in
|
|
the virtual path for the safe interpreter. The <B><A HREF="../TkCmd/source.htm">source</A></B> alias requires
|
|
the safe interpreter to
|
|
use one of the token names in its virtual path to denote the directory in
|
|
which the file to be sourced can be found.
|
|
See the section on <B>SECURITY</B> for more discussion of restrictions on
|
|
valid filenames.
|
|
<P><DT><A NAME="M23"><B>load</B> <I>fileName</I></A><DD>
|
|
The requested file, a shared object file, is dynamically loaded into the
|
|
safe interpreter if it is found.
|
|
The filename must contain a token name mentioned in the virtual path for
|
|
the safe interpreter for it to be found successfully.
|
|
Additionally, the shared object file must contain a safe entry point; see
|
|
the manual page for the <B><A HREF="../TkCmd/load.htm">load</A></B> command for more details.
|
|
<P><DT><A NAME="M24"><B>file</B> ?<I>subCmd args...</I>?</A><DD>
|
|
The <B><A HREF="../TkCmd/file.htm">file</A></B> alias provides access to a safe subset of the subcommands of
|
|
the <B><A HREF="../TkCmd/file.htm">file</A></B> command; it allows only <B>dirname</B>, <B><A HREF="../TkCmd/join.htm">join</A></B>,
|
|
<B>extension</B>, <B>root</B>, <B>tail</B>, <B>pathname</B> and <B><A HREF="../TkCmd/split.htm">split</A></B>
|
|
subcommands. For more details on what these subcommands do see the manual
|
|
page for the <B><A HREF="../TkCmd/file.htm">file</A></B> command.
|
|
<P><DT><A NAME="M25"><B>encoding</B> ?<I>subCmd args...</I>?</A><DD>
|
|
The <B>enconding</B> alias provides access to a safe subset of the
|
|
subcommands of the <B><A HREF="../TkCmd/encoding.htm">encoding</A></B> command; it disallows setting of
|
|
the system encoding, but allows all other subcommands including
|
|
<B>system</B> to check the current encoding.
|
|
<P><DT><A NAME="M26"><B>exit</B></A><DD>
|
|
The calling interpreter is deleted and its computation is stopped, but the
|
|
Tcl process in which this interpreter exists is not terminated.
|
|
|
|
<P></DL>
|
|
<H3><A NAME="M27">SECURITY</A></H3>
|
|
The Safe Base does not attempt to completely prevent annoyance and
|
|
denial of service attacks. These forms of attack prevent the
|
|
application or user from temporarily using the computer to perform
|
|
useful work, for example by consuming all available CPU time or
|
|
all available screen real estate.
|
|
These attacks, while aggravating, are deemed to be of lesser importance
|
|
in general than integrity and privacy attacks that the Safe Base
|
|
is to prevent.
|
|
<P>
|
|
The commands available in a safe interpreter, in addition to
|
|
the safe set as defined in <B><A HREF="../TkCmd/interp.htm">interp</A></B> manual page, are mediated aliases
|
|
for <B><A HREF="../TkCmd/source.htm">source</A></B>, <B><A HREF="../TkCmd/load.htm">load</A></B>, <B><A HREF="../TkCmd/exit.htm">exit</A></B>, and safe subsets of
|
|
<B><A HREF="../TkCmd/file.htm">file</A></B> and <B><A HREF="../TkCmd/encoding.htm">encoding</A></B>. The safe interpreter can also auto-load
|
|
code and it can request that packages be loaded.
|
|
<P>
|
|
Because some of these commands access the local file system, there is a
|
|
potential for information leakage about its directory structure.
|
|
To prevent this, commands that take file names as arguments in a safe
|
|
interpreter use tokens instead of the real directory names.
|
|
These tokens are translated to the real directory name while a request to,
|
|
e.g., source a file is mediated by the master interpreter.
|
|
This virtual path system is maintained in the master interpreter for each safe
|
|
interpreter created by <B>::safe::interpCreate</B> or initialized by
|
|
<B>::safe::interpInit</B> and
|
|
the path maps tokens accessible in the safe interpreter into real path
|
|
names on the local file system thus preventing safe interpreters
|
|
from gaining knowledge about the
|
|
structure of the file system of the host on which the interpreter is
|
|
executing.
|
|
The only valid file names arguments
|
|
for the <B><A HREF="../TkCmd/source.htm">source</A></B> and <B><A HREF="../TkCmd/load.htm">load</A></B> aliases provided to the slave
|
|
are path in the form of
|
|
<B>[file join </B><I>token filename</I><B>]</B> (ie, when using the
|
|
native file path formats: <I>token</I><B>/</B><I>filename</I>
|
|
on Unix, <I>token</I><B>\</B><I>filename</I> on Windows,
|
|
and <I>token</I><B>:</B><I>filename</I> on the Mac),
|
|
where <I>token</I> is representing one of the directories
|
|
of the <I>accessPath</I> list and <I>filename</I> is
|
|
one file in that directory (no sub directories access are allowed).
|
|
<P>
|
|
When a token is used in a safe interpreter in a request to source or
|
|
load a file, the token is checked and
|
|
translated to a real path name and the file to be
|
|
sourced or loaded is located on the file system.
|
|
The safe interpreter never gains knowledge of the actual path name under
|
|
which the file is stored on the file system.
|
|
<P>
|
|
To further prevent potential information leakage from sensitive files that
|
|
are accidentally included in the set of files that can be sourced by a safe
|
|
interpreter, the <B><A HREF="../TkCmd/source.htm">source</A></B> alias restricts access to files
|
|
meeting the following constraints: the file name must
|
|
fourteen characters or shorter, must not contain more than one dot ("<B>.</B>"),
|
|
must end up with the extension <B>.tcl</B> or be called <B>tclIndex</B>.
|
|
<P>
|
|
Each element of the initial access path
|
|
list will be assigned a token that will be set in
|
|
the slave <B>auto_path</B> and the first element of that list will be set as
|
|
the <B>tcl_library</B> for that slave.
|
|
<P>
|
|
If the access path argument is not given or is the empty list,
|
|
the default behavior is to let the slave access the same packages
|
|
as the master has access to (Or to be more precise:
|
|
only packages written in Tcl (which by definition can't be dangerous
|
|
as they run in the slave interpreter) and C extensions that
|
|
provides a Safe_Init entry point). For that purpose, the master's
|
|
<B>auto_path</B> will be used to construct the slave access path.
|
|
In order that the slave successfully loads the Tcl library files
|
|
(which includes the auto-loading mechanism itself) the <B>tcl_library</B> will be
|
|
added or moved to the first position if necessary, in the
|
|
slave access path, so the slave
|
|
<B>tcl_library</B> will be the same as the master's (its real
|
|
path will still be invisible to the slave though).
|
|
In order that auto-loading works the same for the slave and
|
|
the master in this by default case, the first-level
|
|
sub directories of each directory in the master <B>auto_path</B> will
|
|
also be added (if not already included) to the slave access path.
|
|
You can always specify a more
|
|
restrictive path for which sub directories will never be searched by
|
|
explicitly specifying your directory list with the <B>-accessPath</B> flag
|
|
instead of relying on this default mechanism.
|
|
<P>
|
|
When the <I>accessPath</I> is changed after the first creation or
|
|
initialization (ie through <B>interpConfigure -accessPath </B><I>list</I>),
|
|
an <B><A HREF="../TkCmd/library.htm">auto_reset</A></B> is automatically evaluated in the safe interpreter
|
|
to synchronize its <B>auto_index</B> with the new token list.
|
|
|
|
<H3><A NAME="M28">SEE ALSO</A></H3>
|
|
<B><A HREF="../TkCmd/interp.htm">interp</A></B>, <B>library</B>, <B><A HREF="../TkCmd/load.htm">load</A></B>, <B><A HREF="../TkCmd/package.htm">package</A></B>, <B><A HREF="../TkCmd/source.htm">source</A></B>, <B><A HREF="../TkCmd/unknown.htm">unknown</A></B>
|
|
<H3><A NAME="M29">KEYWORDS</A></H3>
|
|
<A href="../Keywords/A.htm#alias">alias</A>, <A href="../Keywords/A.htm#auto-loading">auto-loading</A>, <A href="../Keywords/A.htm#auto_mkindex">auto_mkindex</A>, <A href="../Keywords/L.htm#load">load</A>, <A href="../Keywords/M.htm#master interpreter">master interpreter</A>, <A href="../Keywords/S.htm#safe
|
|
interpreter">safe
|
|
interpreter</A>, <A href="../Keywords/S.htm#slave interpreter">slave interpreter</A>, <A href="../Keywords/S.htm#source">source</A>
|
|
<HR><PRE>
|
|
<A HREF="../copyright.htm">Copyright</A> © 1995-1996 Sun Microsystems, Inc.
|
|
<A HREF="../copyright.htm">Copyright</A> © 1995-1997 Roger E. Critchlow Jr.</PRE>
|
|
</BODY></HTML>
|